Logstash "WMI" input plugin Error ==> Error registering plugin

Elastic Stack Logstash
1

Hello

  • What I'm trying to do
    I used to use ELK in a ubuntu Virtual Machine.
    but I need to use "WMI" input plugin that I can get windows OS information. So I decided to let logstash installed in windwos, and set logstash's output host to ubuntu VM.

  • The problem
    When I try to run logstash I had some errors. I'm thinking that this is because windows OS is not good environment to run logstash. So I followed this reference but it didn't work.
    [reference]Installing Logstash Plugins failing on Windows 10

  • The root cause that i think
    [ERROR][logstash.pipeline ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::WMI query=>"select * from Win32_Process", interval=>10, id=>"3a4f43f5a2b446ce790f1efe0f59b45e2077410e1268a812dbb6583d654ace46", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_c4ead50b-c4b8-471a-9ec9-bfffa2b61ab2", enable_metric=>true, charset=>"UTF-8">, host=>"localhost", namespace=>"root\\cimv2">", :error=>"undefined method `value' for nil:NilClass", :thread=>"#<Thread:0x46759514 run>"}

logstash configuration

input {
wmi {
query => "select * from Win32_Process"
interval => 10
}
}

output {
elasticsearch { hosts => "168.188.127.122:9200" index=> "wmi"}
}

if you want, I will upload the full error. does anyone know why this is happening?

2

This is the full error.

PS C:\Users\SASL\Desktop\logstash-6.1.2\bin> .\logstash.bat -f .\logstash.conf
Sending Logstash's logs to C:/Users/SASL/Desktop/logstash-6.1.2/logs which is now configured via log4j2.properties
[2018-01-20T18:13:14,234][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"C:/Users/SASL/Desktop/logstash-6.1.2/modules/fb_apache/configuration"}
[2018-01-20T18:13:14,257][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"C:/Users/SASL/Desktop/logstash-6.1.2/modules/netflow/configuration"}
[2018-01-20T18:13:14,429][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-01-20T18:13:14,885][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.1.2"}
[2018-01-20T18:13:15,263][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2018-01-20T18:13:17,315][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://168.188.127.122:9200/]}}
[2018-01-20T18:13:17,325][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://168.188.127.122:9200/, :path=>"/"}
[2018-01-20T18:13:17,469][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://168.188.127.122:9200/"}
[2018-01-20T18:13:17,525][INFO ][logstash.outputs.elasticsearch] ES Output version determined {:es_version=>nil}
[2018-01-20T18:13:17,548][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2018-01-20T18:13:17,627][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2018-01-20T18:13:17,683][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//168.188.127.122:9200"]}
[2018-01-20T18:13:17,706][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000, :thread=>"#<Thread:0x46759514 run>"}
[2018-01-20T18:13:17,742][INFO ][logstash.inputs.wmi ] Registering wmi input {:query=>"select * from Win32_Process"}
[2018-01-20T18:13:22,770][ERROR][logstash.pipeline ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::WMI query=>"select * from Win32_Process", interval=>10, id=>"3a4f43f5a2b446ce790f1efe0f59b45e2077410e1268a812dbb6583d654ace46", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_c4ead50b-c4b8-471a-9ec9-bfffa2b61ab2", enable_metric=>true, charset=>"UTF-8">, host=>"localhost", namespace=>"root\\cimv2">", :error=>"undefined method value' for nil:NilClass", :thread=>"#<Thread:0x46759514 run>"} [2018-01-20T18:13:23,583][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<NoMethodError: undefined methodvalue' for nil:NilClass>, :backtrace=>["C:/Users/SASL/Desktop/logstash-6.1.2/vendor/bundle/jruby/2.3.0/gems/logstash-input-wmi-3.0.3-java/lib/logstash/inputs/wmi.rb:65:in register'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:343:inregister_plugin'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:354:in block in register_plugins'", "org/jruby/RubyArray.java:1734:ineach'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:354:in register_plugins'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:510:instart_inputs'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:401:in start_workers'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:288:inrun'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"], :thread=>"#<Thread:0x46759514 run>"}
[2018-01-20T18:13:23,610][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: LogStash::PipelineAction::Create/pipeline_id:main, action_result: false", :backtrace=>nil}

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.