Logstash restarts every 13 seconds

[Wang_Yin]

Hi,

I'm new to ELK, I noticed that the Logstash (version: 8.2.2) restarted every 13 seconds, the log I found in /var/log/logstash/logstash-plain.log suggested that there are some syntax error at line 26 of a certain file, which I couldn't find:

[2022-06-12T13:57:40,154][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "input", "filter", "output" at line 26, column 1 (byte 606) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:50:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:381:in block in converge_state'"]}

It would be greatly appreciated if anyone could shed light on it.

[leandrojmp (Leandro Pereira)]

The error tells that you have a configuration error in one of your configuration files, you need to find the configuration error and fix it.

Please share the contents of logstash.yml, pipelines.yml and the configuration files that you are using in pipelines.yml.

[Wang_Yin]

@leandrojmp Thank you very much for the hint.

I found the issue, there's an additional closing bracket "}" configured in line 26 of the configuration files that's being used in pipelines.yml.

After removing that, the issue is immediately fixed. I have no idea who created that configuration file though.

I'm new to ELK, I am curious about what does pipelines.yml do in logstash, what if I remove that configuration file in /etc/logstash/conf.d/*.conf (the value of path.config specified in pipelines.yml), will there be any side effects?

[rugenl (Len Rugen)]

I for one would vote for a feature that made these errors more readable and useful

[Badger]

I believe it is doable. See this issue.