Logstash pipeline error

Hello team,
I am getting following issuw on logstash side. can anyone help me.

Error:

[2021-12-29T16:50:48,240][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:jira, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: Invalid pattern specification", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:119)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:80)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:82)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$__VARARGS__(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:82)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:356)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
[2021-12-29T16:50:48,531][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<jira>`>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in `create'", "org/logstash/execution/ConvergeResultExt.java:57:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:369:in `block in converge_state'"]}


Logstash pipeline:

input {
    beats {port => 5046}
}

  filter {
		if ([component] == "enbd-jira-atlassianjiragc" or [component] == "enbd-jira-atlassianjirasecurity" or [component] == "enbd-jira-atlassianjiraoutgoingmail" or [component] == "enbd-jira-atlassianjiraperf" or [component] == "enbd-jira-atlassianjira" or [component] == "enbd-jira-atlassiangreenhopper"){
            grok {
                match => {
                    message => [
						'%{GREEDYDATA:message1}'
                    ]
                }
            }
 mutate {
            add_field => { "log" => "%{time} %{message}" }
        }
            date {
                match => ["time", "yyyy-MM-dd'T'HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS"]
                target => "@timestamp"
                locale => "en"
                timezone => "+04:00"
                remove_tag => ["_timestampparsefailure"]
            }
            mutate  {
                remove_field => ["message1","message","kafkatime"]
            }

		
}else if [component] == "enbd-jira-accesslog"{
			grok {
                match => {
                    message => [
						'%{GREEDYDATA:message1}'
                    ]
                }
            }
			mutate {
				add_field => { "log" => "%{ip} %{data} %{time} %{message}" }
			}
            date {
                match => ["time", "dd/MMM/yyyy:HH:mm:ss"]
                target => "@timestamp"
                locale => "en"
                timezone => "+04:00"
                remove_tag => ["_timestampparsefailure"]
            }
            mutate  {
                remove_field => ["message1","message","kafkatime"]
            }	
		}	
    
}

output {
    if [type] == "enbd-jira"{
        elasticsearch {
			hosts => ["https://1.1.1.1:9200","https://1.1.1.1:9200"]
            user => "${logstash_user}"
            password => "${logstash_password}"
            ssl => true
            ssl_certificate_verification => false
            cacert  => "/etc/logstash/certs/admincert.pem"
            manage_template => false
            index => "enbd-jira-%{+YYYY.MM.dd}"
			id => "enbd-jira-output"
        }
    }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.