Logstash WMI plugin logstash-input-wmi error

  • Hi, I use logstash to collect wmi remotely on linux.
    input {

prueba local

input {
wmi {
query => "select * from Win32_Process"
host => "192.168.146.203"
user => "Administrator"
password => "1909"
}
}

output {
stdout {}
}
This is the error i have, I try to solve by diferent soluctions and 1 can't
[2022-11-17T16:32:15,981][INFO ][logstash.javapipeline ][main] Pipeline terminated {"pipeline.id"=>"main"}
warning: thread "[main]-pipeline-manager" terminated with exception (report_on_exception is true):
LoadError: load error: win32ole/win32ole -- java.lang.UnsatisfiedLinkError: /elk/logstash/logstash-8.5.1/vendor/bundle/jruby/2.6.0/gems/jruby-win32ole-0.8.5/lib/racob-x64.dll: /elk/logstash/logstash-8.5.1/vendor/bundle/jruby/2.6.0/gems/jruby-win32ole-0.8.5/lib/racob-x64.dll: 无效的 ELF 头
require at org/jruby/RubyKernel.java:1017
at /elk/logstash/logstash-8.5.1/vendor/bundle/jruby/2.6.0/gems/jruby-win32ole-0.8.5/lib/jruby-win32ole.rb:10
require at org/jruby/RubyKernel.java:1017
register at /elk/logstash/logstash-8.5.1/vendor/bundle/jruby/2.6.0/gems/logstash-input-wmi-3.0.4-java/lib/logstash/inputs/wmi.rb:53
register_plugins at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:234
each at org/jruby/RubyArray.java:1865
register_plugins at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:233
start_inputs at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:392
start_workers at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:317
run at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:191
start at /elk/logstash/logstash-8.5.1/logstash-core/lib/logstash/java_pipeline.rb:143
[2022-11-17T16:32:15,989][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

Thank you
Regards
Ana

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.