# Logstash RabbitMQ input plugin configuration

**URL:** <https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222>\
**Category:** Logstash\
**Created:** [January 29, 2019, 6:46pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222 "2019-01-29T18:46:11Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shimpi](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@shimpi](https://discuss.elastic.co/u/shimpi)\
**Post date:** [January 29, 2019, 6:46pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/1 "2019-01-29T18:46:12Z")

</div>

Hello,

My goal is:  
1: Configure Logstash (version: 6.2.1) to pull events from RabbitMQ (version: 3.6.1) ( as input)  
2: Depending upon the content of the event (message), store them in different files (as output)

Right now, I'm struggling to achieve my first goal. Here's my logstash config:  
input {  
rabbitmq {  
host =\> "localhost"  
durable =\> true  
exchange =\> "RSLOG"  
queue =\> "RSLOG"  
}  
}

output {  
stdout { }  
}

After starting logstash, the log, along with some startup messages prints this:  
[2019-01-29T09:41:47,284][ERROR][logstash.inputs.rabbitmq] RabbitMQ connection error, will retry. {:error\_message=\>"Connection to localhost:5672 failed: timeout", :exception=\>"MarchHare::ConnectionRefused"}

I tried adding port to the configuration. But no mater what port number I add, logstash prints the same message. There no service on my local box which is listening on port 5672.  
What is this port? Is this the port where rabbit listens on for admin console (15672)?

Documentation says:

> This plugin uses the [March Hare](http://rubymarchhare.info/) library for interacting with the RabbitMQ server.

Unfortunately I didn't find anywhere how to install and configure it.

After I get my goal 1 working, is it possible to achieve my goal 2?

Any help is greatly appreciated!!

Thanks!  
Mangesh

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 7:26pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/2 "2019-01-29T19:26:33Z")

</div>

> [@shimpi](#):
>
> There no service on my local box which is listening on port 5672.  
> What is this port? Is this the port where rabbit listens on for admin console (15672)?

No, 15672 is the admin interface. 5672 is the port used to talk AQMP. Have you configured a listener in your RabbitMQ configuration?

---

<div class="post-metadata">

**Author:** ![shimpi](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@shimpi](https://discuss.elastic.co/u/shimpi)\
**Post date:** [January 29, 2019, 7:48pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/3 "2019-01-29T19:48:25Z")

</div>

Hello @Badger

That was the missing link. I enabled the tcp\_listener at 5672. This time, logstash could not authenticate. Here's the message:

> [2019-01-29T11:41:50,274][ERROR][logstash.inputs.rabbitmq] RabbitMQ connection error, will retry. {:error\_message=\>"Authentication with RabbitMQ failed or RabbitMQ version used does not support AMQP 0-9-1. Username: guest, vhost: /, password length: 5. Please check your configuration.", :exception=\>"MarchHare::AuthenticationFailureError"}

Thanks!

---

<div class="post-metadata">

**Author:** ![shimpi](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@shimpi](https://discuss.elastic.co/u/shimpi)\
**Post date:** [January 29, 2019, 8:08pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/4 "2019-01-29T20:08:29Z")

</div>

Hello @Badger

That worked! Now, logstash is listening on a queue for any event and the moment it receives it, it dumps it on the console.

The event (message) will be a text and will have a component name from where it got sent. My other goal is to parse it and log it in different files.

Do you think it's doable using logstash?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 8:17pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/5 "2019-01-29T20:17:31Z")

</div>

That should be doable using logstash. Look at the dissect and grok filters for parsing. You can use a file output and have the filename depend on the contents of the message. For example, this configuration will put one line in /tmp/foo2 and one in /tmp/foo3.

```
input { generator { count => 1 message => '{ "target": "foo2" }' } }
input { generator { count => 1 message => '{ "target": "foo3" }' } }
filter { json { source => "message" } }
output { file { path => "/tmp/%{target}" } }
```

---

<div class="post-metadata">

**Author:** ![shimpi](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@shimpi](https://discuss.elastic.co/u/shimpi)\
**Post date:** [January 29, 2019, 8:57pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/6 "2019-01-29T20:57:45Z")

</div>

Hi @Badger,

That's great information. It educated me and saved a lot of my time already!

A Very Big Thank You!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 8:57pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-configuration/166222/7 "2019-02-26T20:57:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.