Hello Elasticians !
I installed syslog output plug in (logstash-output-syslog-3.0.5.gem) using offline method as I don't have wan access on target server.
Plug in has been successfully installed and is listed with
logstash-plugin list
But when I want to use it as follow :
output {
syslog {
host => "1.2.3.4"
port => 777
protocol => "tcp"
}
I have this error :
[2020-12-30T15:31:57,847][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:filebeat_linux, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (PluginLoadingError) Couldn't find any output plugin named 'syslog'. Are you sure this is correct? Trying to load the syslog output plugin resulted in this error: no such file to load -- logstash/outputs/syslog", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:119)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:82)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:84)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:98)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:226)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:213)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:216)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$__VARARGS__(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
[2020-12-30T15:31:58,015][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<filebeat_linux>`>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in `create'", "org/logstash/execution/ConvergeResultExt.java:57:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:370:in `block in converge_state'"]}
[2020-12-30T15:31:58,054][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
plugin list :
> # /usr/share/logstash/bin/logstash-plugin list --verbose | grep syslog
> logstash-filter-syslog_pri (3.0.5)
> logstash-input-syslog (3.4.4)
> logstash-output-syslog (3.0.5)
plugin specifications
# cat /usr/share/logstash/vendor/bundle/jruby/2.5.0/specifications/logstash-output-syslog-3.0.5.gemspec
# -*- encoding: utf-8 -*-
# stub: logstash-output-syslog 3.0.5 ruby lib
Gem::Specification.new do |s|
s.name = "logstash-output-syslog".freeze
s.version = "3.0.5"
s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
s.metadata = { "logstash_group" => "output", "logstash_plugin" => "true" } if s.respond_to? :metadata=
s.require_paths = ["lib".freeze]
s.authors = ["Elastic".freeze]
s.date = "2018-04-06"
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program".freeze
s.email = "info@elastic.co".freeze
s.files = ["CHANGELOG.md".freeze, "CONTRIBUTORS".freeze, "Gemfile".freeze, "LICENSE".freeze, "NOTICE.TXT".freeze, "README.md".freeze, "docs/index.asciidoc".freeze, "lib/logstash/outputs/syslog.rb".freeze, "logstash-output-syslog.gemspec".freeze, "spec/outputs/syslog_spec.rb".freeze]
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html".freeze
s.licenses = ["Apache License (2.0)".freeze]
s.rubygems_version = "3.0.6".freeze
s.summary = "Sends events to a `syslog` server".freeze
s.installed_by_version = "3.0.6" if s.respond_to? :installed_by_version
if s.respond_to? :specification_version then
s.specification_version = 4
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
s.add_runtime_dependency(%q<logstash-core-plugin-api>.freeze, [">= 1.60", "<= 2.99"])
s.add_runtime_dependency(%q<logstash-codec-plain>.freeze, [">= 0"])
s.add_development_dependency(%q<logstash-devutils>.freeze, [">= 0"])
s.add_development_dependency(%q<logstash-codec-json>.freeze, [">= 0"])
else
s.add_dependency(%q<logstash-core-plugin-api>.freeze, [">= 1.60", "<= 2.99"])
s.add_dependency(%q<logstash-codec-plain>.freeze, [">= 0"])
s.add_dependency(%q<logstash-devutils>.freeze, [">= 0"])
s.add_dependency(%q<logstash-codec-json>.freeze, [">= 0"])
end
else
s.add_dependency(%q<logstash-core-plugin-api>.freeze, [">= 1.60", "<= 2.99"])
s.add_dependency(%q<logstash-codec-plain>.freeze, [">= 0"])
s.add_dependency(%q<logstash-devutils>.freeze, [">= 0"])
s.add_dependency(%q<logstash-codec-json>.freeze, [">= 0"])
end
end
Thanks for your help ! 