Logstash Running Error

Elastic Stack Logstash
1

I'm trying to run logstash with a new .conf file and i riceve this error:

[ERROR] 2022-02-18 12:40:51.495 [Converge PipelineAction::Create] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

Could u help me?

2

There should definitely be an additional message saying what exception occurred. If there is not one, try running --log.level debug

4

WARNING: An illegal reflective access operation has occurred

WARNING: Illegal reflective access by org.jruby.ext.openssl.SecurityHelper (file:/tmp/jruby-930972/jruby2955394990557876552jopenssl.jar) to field java.security.MessageDigest.provider

WARNING: Please consider reporting this to the maintainers of org.jruby.ext.openssl.SecurityHelper

WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations

WARNING: All illegal access operations will be denied in a future release

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults

Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console

[INFO ] 2022-02-21 10:51:33.080 [main] runner - Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 11.0.10+8-LTS-162 on 11.0.10+8-LTS-162 +indy +jit [linux-x86_64]"}

[WARN ] 2022-02-21 10:51:33.372 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified

[INFO ] 2022-02-21 10:51:35.423 [Converge PipelineAction::Create] Reflections - Reflections took 32 ms to scan 1 urls, producing 22 keys and 45 values

[ERROR] 2022-02-21 10:51:35.978 [Converge PipelineAction::Create] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

5

with -log.level debug i saw this:
[DEBUG] 2022-02-21 10:59:55.569 [[main]-pipeline-manager] javapipeline - Pipeline terminated by worker error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: translation missing: en.logstash.agent.configuration.invalid_plugin_register>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-mutate-3.5.0/lib/logstash/filters/mutate.rb:222:in block in register'", "org/jruby/RubyHash.java:1415:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-mutate-3.5.0/lib/logstash/filters/mutate.rb:220:in register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:226:in block in register_plugins'", "org/jruby/RubyArray.java:1809:in each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:225:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:560:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:238:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:183:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:134:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/mypipeline.conf"], :thread=>"#<Thread:0x2d5dd59c run>"}
[ERROR] 2022-02-21 10:59:55.582 [Converge PipelineAction::Create] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

6

That error occurs here.

You have a mutate filter with a convert option and one of the converts has an invalid type. For example

mutate { convert => { "[some][field]" => "text" } }

The error field of the exception contains the exact details of what the incorrect option is, but sadly logstash does not print that.