I am using Logstash version 7.5.2 and below is my conf file for tcp input test
input {
tcp {
port => "5666"
host => "localhost"
type => "syslog"
}
}
filter {
grok {
patterns_dir => ["/master_pattern"]
match => {
"message" => [
"%{TIMESTAMP_ISO8601:sys_timestamp} %{PROGRAM_HOST_NAME:program_host_name}: %{PROGRAM_FUNCTION:program_function}: %{LOG_MSG:log_msg}",
"%{TIMESTAMP_ISO8601:sys_timestamp} %{PROGRAM_HOST_NAME:program_host_name}: %{LOG_MSG:log_msg}"
]
} #End of MATCH
} #End of GROK
date {
match => [ "sys_timestamp" , "dd-MM-yy HH:mm:ss" ]
target => "@timestamp"
} #End of Date
if [program_function] == "age_log" {
grok {
patterns_dir => ["/master_pattern"]
match => {
"log_msg" => [
"%{AGELOG_MSG:age_log_msg} %{LOG_MSG:log_msg}",
"%{LOG_MSG:log_msg}"
]
}# End of Nested-Match
}# End of GROK
}# End of IF-STATEMENT
if [program_function] == "LgfPushSln.ec(30)" {
grok {
patterns_dir => ["/master_pattern"]
match => {
"log_msg" => [
"%{SLOT_MSG_LGF:slot_msg_lgf} '%{LGF_NUMBER:lgf_number} '",
"%{LOG_MSG:log_msg}"
]
}# End of Nested-Match
}# End of GROK
}# End of IF-STATEMENT
if [program_function] == "BgtSmar" {
grok {
patterns_dir => ["/master_pattern"]
match => {
"log_msg" => [
"%{SLOT_MSG_BGTSMAR:slot_msg_bgtsmar}",
"%{LOG_MSG:log_msg}"
]
}# End of Nested-Match
}# End of GROK
}# End of IF-STATEMENT
}
output {
elasticsearch {
hosts => ["localhost:9200/"]
index => "test-tcp-1"
}
and here is the error msg,
[2020-02-29T11:23:32,590][ERROR][logstash.javapipeline ][main] A plugin had an unrecoverable error. Will restart this plugin.
Pipeline_id:main
Plugin: <LogStash::Inputs::Tcp host=>"10.61.35.162", id=>"0df5922092fe0a1341b11e7bd1e7a9d4b7550816169171fc9006ed0b49841027", type=>"syslog", port=>5666, enable_metric=>true, codec=><LogStash::Codecs::Line id=>"line_43af8410-bc1b-4eea-b225-de67ff995966", enable_metric=>true, charset=>"UTF-8", delimiter=>"\n">, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=>, tcp_keep_alive=>false, dns_reverse_lookup_enabled=>true>
Error: event executor terminated
Exception: Java::JavaUtilConcurrent::RejectedExecutionException
Stack: io.netty.util.concurrent.SingleThreadEventExecutor.reject(io/netty/util/concurrent/SingleThreadEventExecutor.java:821)
io.netty.util.concurrent.SingleThreadEventExecutor.offerTask(io/netty/util/concurrent/SingleThreadEventExecutor.java:327)
io.netty.util.concurrent.SingleThreadEventExecutor.addTask(io/netty/util/concurrent/SingleThreadEventExecutor.java:320)
io.netty.util.concurrent.SingleThreadEventExecutor.execute(io/netty/util/concurrent/SingleThreadEventExecutor.java:746)
io.netty.channel.AbstractChannel$AbstractUnsafe.register(io/netty/channel/AbstractChannel.java:479)
io.netty.channel.SingleThreadEventLoop.register(io/netty/channel/SingleThreadEventLoop.java:80)
io.netty.channel.SingleThreadEventLoop.register(io/netty/channel/SingleThreadEventLoop.java:74)
io.netty.channel.MultithreadEventLoopGroup.register(io/netty/channel/MultithreadEventLoopGroup.java:86)
io.netty.bootstrap.AbstractBootstrap.initAndRegister(io/netty/bootstrap/AbstractBootstrap.java:331)
io.netty.bootstrap.AbstractBootstrap.doBind(io/netty/bootstrap/AbstractBootstrap.java:282)
io.netty.bootstrap.AbstractBootstrap.bind(io/netty/bootstrap/AbstractBootstrap.java:278)
io.netty.bootstrap.AbstractBootstrap.bind(io/netty/bootstrap/AbstractBootstrap.java:260)
org.logstash.tcp.InputLoop.run(org/logstash/tcp/InputLoop.java:87)
java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)
org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:440)
org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:304)
home.UUM04486.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_tcp_minus_6_dot_0_dot_3_minus_java.lib.logstash.inputs.tcp.run(/home/UUM04486/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-tcp-6.0.3-java/lib/logstash/inputs/tcp.rb:152)
home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.inputworker(/home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb:332)
home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$inputworker$0$VARARGS(home/UUM04486/logstash/logstash_minus_core/lib/logstash//home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb)
home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_input(/home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb:324)
org.jruby.RubyProc.call(org/jruby/RubyProc.java:295)
org.jruby.RubyProc.call(org/jruby/RubyProc.java:274)
org.jruby.RubyProc.call(org/jruby/RubyProc.java:270)
java.lang.Thread.run(java/lang/Thread.java:748)
^C[2020-02-29T11:23:33,596][INFO ][logstash.inputs.tcp ][main] Starting tcp input listener {:address=>"10.61.35.162:5666", :ssl_enable=>"false"}
[2020-02-29T11:23:33,599][WARN ][io.netty.channel.AbstractChannel][main] Force-closing a channel whose registration task was not accepted by an event loop: [id: 0xa8cda637]
java.util.concurrent.RejectedExecutionException: event executor terminated
at io.netty.util.concurrent.SingleThreadEventExecutor.reject(SingleThreadEventExecutor.java:821) ~[logstash-input-tcp-6.0.3.jar:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.offerTask(SingleThreadEventExecutor.java:327) ~[logstash-input-tcp-6.0.3.jar:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.addTask(SingleThreadEventExecutor.java:320) ~[logstash-input-tcp-6.0.3.jar:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.execute(SingleThreadEventExecutor.java:746) ~[logstash-input-tcp-6.0.3.jar:?]
at io.netty.channel.AbstractChannel$AbstractUnsafe.register(AbstractChannel.java:479) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.channel.SingleThreadEventLoop.register(SingleThreadEventLoop.java:80) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.channel.SingleThreadEventLoop.register(SingleThreadEventLoop.java:74) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.channel.MultithreadEventLoopGroup.register(MultithreadEventLoopGroup.java:86) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.bootstrap.AbstractBootstrap.initAndRegister(AbstractBootstrap.java:331) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.bootstrap.AbstractBootstrap.doBind(AbstractBootstrap.java:282) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.bootstrap.AbstractBootstrap.bind(AbstractBootstrap.java:278) [logstash-input-tcp-6.0.3.jar:?]
at io.netty.bootstrap.AbstractBootstrap.bind(AbstractBootstrap.java:260) [logstash-input-tcp-6.0.3.jar:?]
at org.logstash.tcp.InputLoop.run(InputLoop.java:87) [logstash-input-tcp-6.0.3.jar:?]
at sun.reflect.GeneratedMethodAccessor26.invoke(Unknown Source) ~[?:?]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_241]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_241]
at org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(JavaMethod.java:440) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.javasupport.JavaMethod.invokeDirect(JavaMethod.java:304) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.java.invokers.InstanceMethodInvoker.call(InstanceMethodInvoker.java:36) [jruby-complete-9.2.8.0.jar:?]
at home.UUM04486.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_tcp_minus_6_dot_0_dot_3_minus_java.lib.logstash.inputs.tcp.RUBY$method$run$0(/home/UUM04486/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-tcp-6.0.3-java/lib/logstash/inputs/tcp.rb:152) [jruby-complete-9.2.8.0.jar:?]
at home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$inputworker$0(/home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb:332) [jruby-complete-9.2.8.0.jar:?]
at home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$inputworker$0$VARARGS(/home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183) [jruby-complete-9.2.8.0.jar:?]
at home.UUM04486.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$block$start_input$1(/home/UUM04486/logstash/logstash-core/lib/logstash/java_pipeline.rb:324) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.runtime.Block.call(Block.java:129) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.RubyProc.call(RubyProc.java:295) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.RubyProc.call(RubyProc.java:274) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.RubyProc.call(RubyProc.java:270) [jruby-complete-9.2.8.0.jar:?]
at org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105) [jruby-complete-9.2.8.0.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_241]
Everything is good before I testing on TCP input. How can I solve this problems?