Logstash not receiving server logs

Elastic Stack Logstash
1

Hi Am trying to config logstash server for my application server. I am not able to see the logs in the logstash. I need some ones help to check this configuration.

2

If you provide additional details about your configuration we might be able to help.

3

Sure .

This is the instruction which i have followed to setup logstash server.

But am not able to see the the logs in Kibana.

Thanks,

4

/var/log/elasticsearch

in this log i have seen the exception

[2015-08-04 10:03:17,617][DEBUG][action.search.type ] [White Pilgrim] [logstash-2015.07.30][2], node[2JOk8_wnSqSpz5ZG9fFcrg], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@5e70f38b] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-2015.07.30][2]: from[-1],size[500]: Parse Failure [Failed to parse source [{"size":500,"sort":{"received_at":"desc"},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}}},"aggs":{"2":{"date_histogram":{"field":"received_at","interval":"30m","pre_zone":"+05:30","pre_zone_adjust_large_interval":true,"min_doc_count":0,"extended_bounds":{"min":1438626600000,"max":1438712999999}}}},"query":{"filtered":{"query":{"match_all":{}},"filter":{"bool":{"must":[{"range":{"received_at":{"gte":1438626600000,"lte":1438712999999}}}],"must_not":[]}}}},"fields":["","_source"],"script_fields":{},"fielddata_fields":["@timestamp","received_at"]}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:687)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:543)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:515)
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:277)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.elasticsearch.search.SearchParseException: [logstash-2015.07.30][2]: from[-1],size[500]: Parse Failure [No mapping found for [received_at] in order to sort on]
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:210)
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:141)
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:671)
... 9 more
[2015-08-04 10:03:17,620][DEBUG][action.search.type ] [White Pilgrim] [logstash-2015.08.02][4], node[2JOk8_wnSqSpz5ZG9fFcrg], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@5e70f38b] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-2015.08.02][4]: from[-1],size[500]: Parse Failure [Failed to parse source [{"size":500,"sort":{"received_at":"desc"},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}}},"aggs":{"2":{"date_histogram":{"field":"received_at","interval":"30m","pre_zone":"+05:30","pre_zone_adjust_large_interval":true,"min_doc_count":0,"extended_bounds":{"min":1438626600000,"max":1438712999999}}}},"query":{"filtered":{"query":{"match_all":{}},"filter":{"bool":{"must":[{"range":{"received_at":{"gte":1438626600000,"lte":1438712999999}}}],"must_not":[]}}}},"fields":["","_source"],"script_fields":{},"fielddata_fields":["@timestamp","received_at"]}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:687

5

Hi,

What information do like to see ?

Thanks,

6

/var/log/nginx

I have seen this error in /var/log/nginx

265 2015/08/05 09:37:02 [error] 980#0: *7670 connect() failed (111: Connection refused) while connecting to upstream, client: 115.160.252.214, server: kachyng.log.com, request: "POST /elasticsearch/_msearch?timeout=0&ignore_unavailable=true&preference=1438754906134 HTTP/1.1", upstream: "http://[::1]:5601/elasticsearch/_msearch?timeout=0&ignore_unavailable=true&preference=1438754906134", host: "ec2-54-158-167-177.compute-1.amazonaws.com", referrer: "http://ec2-54-158-167-177.compute-1.amazonaws.com/"