Logstash not working fine

Elastic Stack Logstash
1

When I am trying to run as I am transferring data from csv file to Elasticsearch using logstash.
My logstash.conf as follows

input {      
	file {
		path => "C:/Users/user/Downloads/abc/abc.csv"
		start_position => "beginning"
		sincedb_path => "NULL"
	}
}
filter{
	csv{
		separator => ","
		columns => ["a","b","c","d"]
	}
}


output {
	elasticsearch{
		hosts=> "http://localhost:9200"
		index=> "logstash-%{+YYYY.MM.dd}"
	}
	stdout {}
}

The following error is occurred. Please let me know.

sns
sns1900×88 12 KB

2

Welcome to our community! :smiley:
Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them :slight_smile:

1 Like
3

No it is not. The error message includes parts of the configuration and they do not match that. Please post the entire error message (and as Mark said, post it as text, not an image).

sincedb_path => "NULL" will persist the in-memory sincedb across restarts in a file called NULL in the working directory of logstash. If you do not want it persisted then use sincedb_path => "NUL". Microsoft made NUL a special file name...

1 Like
4

Please find the full error. Thanks

[2022-11-06T23:12:29,594][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", [A-Za-z0-9_-], '\"', \"'\", [A-Za-z_], \"-\", [0-9], \"[\", \"{\", \"]\" at line 8, column 12 (byte 71) after output{\n elasticsearch{\n hosts => [", :backtrace=>["C:/Users/user/Downloads/logstash-8.5.0/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:182:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "C:/Users/user/Downloads/logstash-8.5.0/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:911:in `new'", "C:/Users/user/Downloads/logstash-8.5.0/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute'", "C:/Users/user/Downloads/logstash-8.5.0/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]}
[2022-11-06T23:12:29,729][INFO ][logstash.runner          ] Logstash shut down.
[2022-11-06T23:12:29,749][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
5

So whatever comes after that [ is the problem. The hosts option of an elasticsearch output has to be a uri. But I think a uri can be an array of strings, each of which is a URI.

Do you have hosts => [ http://... instead of hosts => [ "https://...

Thankyou for posting the text of the error message.

1 Like
6

It worked. Thanks. I added array instead of string and also replaced inverted commas as I copied from the web and it might be something else instead of inverted commas. You are my idol.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.