Logstash configuration parsing is:
input {
tcp {
port => "5141"
codec => json
type => "syslog"
}
}
filter {
grok {
match => { "message" => "%{SYSLOG5424PRI:syslog_index}-\s*%{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_message}" }
}
json {
source => "syslog_message"
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["https://xxxxxx:9200", "https://xxxxxx:9200"]
user => "xxxxx"
password => "xxxxxxxx"
cacert => "/etc/logstash/certs/ca.crt"
index => "jstest-%{+YYYY.MM.dd}"
action => "index"
}
}
When I make the following command: tail -f /var/log/logstash/logstash-plain.log
The output I have below:
[2021-01-13T13:15:39,994][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>".monitoring-logstash"}
[2021-01-13T13:15:40,341][INFO ][logstash.runner ] Logstash shut down.
[2021-01-13T13:15:52,090][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.8.0", "jruby.version"=>"jruby 9.2.11.1 (2.5.7) 2020-03-25 b1f55b1a40 Java HotSpot(TM) 64-Bit Server VM 14.0.1+7 on 14.0.1+7 +indy +jit [linux-x86_64]"}
[2021-01-13T13:15:53,436][INFO ][logstash.monitoring.internalpipelinesource] Monitoring License OK
[2021-01-13T13:15:53,441][INFO ][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline.
[2021-01-13T13:15:53,891][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "if", [A-Za-z0-9_-], '"', "'", "}" at line 29, column 1 (byte 580) after output {\n stdout { codec => rubydebug }\n elasticsearch {\n hosts => ["https://ELASTIC1:9200", "https://ELASTIC2:9200"]\n user => "elastic"\n password => "xxxxxx"\n cacert => "/etc/logstash/certs/ca.crt"\n index => "jstest-%{+YYYY.MM.dd}"\n action => "index"\n}\n", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in block in converge_state'"]}
[2021-01-13T13:15:54,100][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "if", [A-Za-z0-9_-], '"', "'", "}" at line 29, column 1 (byte 580) after output {\n stdout { codec => rubydebug }\n elasticsearch {\n hosts => ["https://ELASTIC1:9200", "https://ELASTIC2:9200"]\n user => "elastic"\n password => "wTWSIJIzYjCgSApPWbFD"\n cacert => "/etc/logstash/certs/ca.crt"\n index => "jstest-%{+YYYY.MM.dd}"\n action => "index"\n}\n", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in block in converge_state'"]}
[2021-01-13T13:15:54,490][INFO ][org.reflections.Reflections] Reflections took 27 ms to scan 1 urls, producing 21 keys and 41 values
[2021-01-13T13:15:54,672][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] ** WARNING ** Detected UNSAFE options in elasticsearch output configuration!
** WARNING ** You have enabled encryption but DISABLED certificate verifi
I need help.