Logstash problem with disabling ecs_compatibility

Elastic Stack Logstash
1

logstash image is: 7.17.3 with the prune plugin
This is my logstash.conf

    pipeline.ecs_compatibility: disabled 
    input {
      beats {
        port => "XXXXXX"
        ecs_compatibility => disabled
      }
    }
    
    filter {
      prune {
        remove_field => [ "[agent][version]"]
        ecs_compatibility => disabled
      }
    }

    output { 
      elasticsearch { 
        hosts => "XXXXXXXXXXXX"
        ecs_compatibility => disabled
      } 
    }

I get this error with pipeline.ecs_compatibility: disabled
I found this setting at ECS in Logstash | Logstash Reference [7.17] | Elastic

[2022-12-21T08:56:07,531][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 8, column 1 (byte 195) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}
[2022-12-21T08:56:07,729][INFO ][logstash.runner          ] Logstash shut down.
[2022-12-21T08:56:07,736][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit

And without the pipeline.ecs_compatibility: disabled Logstash spamming this.

Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.

Is there another way to get rid of this log spamming?

2

This should not be in your pipeline configuration file, it needs to be in logstash.yml file or if you are using multiple pipelines, in the pipelines.yml file.

In pipeline configurations you can only have input, filter, and output blocks, everything needs to be inside one of those blocks.

3 Likes
3

I appreciate your help
It works. :smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.