Logstash.yml confilct when configuring modules in it. Using the official elastic logstash docker image

Elastic Stack Logstash
1

Hi,

I have configured the azure module in logstash.yml, but after the container starts im receiving this error:

ERROR: Settings 'path.config' (-f) or 'config.string' (-e) can't be used in conjunction with (--modules) or the "modules:" block in the logstash.yml file.

I followed these instructions:
https://www.elastic.co/guide/en/logstash/current/azure-module.html

Now im basically stuck.

Can someone help me out?

Thanks in advance

2

How are you starting logstash?

3

Im starting it with kubernetes.

Added this to my logstash.yml:

logstash.yml: |-
http.host: "0.0.0.0"
path.config: /usr/share/logstash/pipeline
xpack.monitoring.elasticsearch.url: http://elastic:9200
xpack.monitoring.enabled: true
modules:
- name: azure
var.elasticsearch.hosts: elastic:9200
var.kibana.host: kibana:80
var.input.azure_event_hubs.decorate_events: true
var.input.azure_event_hubs.consumer_group: "logstash"
var.input.azure_event_hubs.storage_connection: "DefaultEndpointsProtocol=xxx;EndpointSuffix=core.windows.net"
var.input.azure_event_hubs.threads: 8
var.input.azure_event_hubs.event_hub_connections:
- "Endpoint=xxxxx

4

Exactly what logstash command line does starting it with kubernetes result in?

5

I wouldnt know what commandline it starts.
Well this what is configured:

    args:
    - -f
    - /usr/share/logstash/pipeline/logstash.conf

This is the deployment config that i have. But the commands inside of the container is unknown to me:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: logstash-application
spec:
template:
metadata:
labels:
app: logstash-application
spec:
containers:
- image: docker.elastic.co/logstash/logstash:6.6.0
name: logstash-application
ports:
- name: logstash
containerPort: 5044
protocol: TCP
volumeMounts:
- name: config
mountPath: /usr/share/logstash/config/logstash.yml
subPath: logstash.yml
readOnly: true
- name: pipeline
mountPath: /usr/share/logstash/pipeline
readOnly: true
args:
- -f
- /usr/share/logstash/pipeline/logstash.conf
resources:
limits:
memory: 1Gi
cpu: "500m"
requests:
memory: 1Gi
cpu: "500m"
volumes:
- name: pipeline
configMap:
name: logstash-application
items:
- key: logstash.conf
path: logstash.conf
- name: config
configMap:
name: logstash-application
items:
- key: logstash.yml
path: logstash.yml

6

OK, so that's the problem.

You configured it to be started using '-f /usr/share/logstash/pipeline/logstash.conf' but you have also configured a module. You cannot have both.

7

So what would be the right way to get this working?
Because i even turned it off in the config but still it failed with the same message.

Anyone else that is having this issue with the docker logstash image??

2 Likes
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.