Hi Forum.
Been struggling with my ELK setup, but cannot make it work as I intend - and not sure where I'm going wrong.
Using Elasticsearch,Kibana, Logstash and filebeat --> from this guide: How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 20.04 | DigitalOcean
So I actually managed to setup that it'll log from my PFsense router --> when following this guide : http://pfelk.3ilson.com/
But now - I would like to allow filebeat to listen to mnultiple Pipeline
#
- pipeline.id: pfelk
path.config: "/etc/pfelk/conf.d/*.conf"
# - pipeline.id: main
# path.config: "/etc/logstash/conf.d/*.conf"
As soon as I uncomment the main pipeline my filebeat stops workling and shuts down
Apr 14 11:23:06 app-srv06 logstash[4946]: ERROR: Failed to read pipelines yaml file. Location: /etc/logstash/pipelines.yml
Apr 14 11:23:06 app-srv06 logstash[4946]: usage:
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash -f CONFIG_PATH [-t] [-r] [] [-w COUNT] [-l LOG]
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash --modules MODULE_NAME [-M "MODULE_NAME.var.PLUGIN_TYPE.PLUGIN_NAME.VARIABLE_NAME=VALUE"] [-t] [-w COUNT] [-l LOG]
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash -e CONFIG_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]
Apr 14 11:23:06 app-srv06 logstash[4946]: bin/logstash --help
Apr 14 11:23:06 app-srv06 logstash[4946]: [2021-04-14T11:23:06,381][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
Apr 14 11:23:06 app-srv06 logstash[4946]: org.jruby.exceptions.SystemExit: (SystemExit) exit
Apr 14 11:23:06 app-srv06 logstash[4946]: #011at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.13.0.jar:?]
Apr 14 11:23:06 app-srv06 logstash[4946]: #011at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.13.0.jar:?]
Apr 14 11:23:06 app-srv06 logstash[4946]: #011at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]
Apr 14 11:23:06 app-srv06 systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Apr 14 11:23:06 app-srv06 systemd[1]: logstash.service: Failed with result 'exit-code'
So I cannot figure this out why this fails - and how to add the second pipeline ?
Can anyone guide me - I looked on this site Multiple Pipelines | Logstash Reference [7.12] | Elastic - But I cannjot make it work - so it'll run the 2 pipelines here
After enabling the second pipeline - I'm getting this error constantly( And goes away as soon as I comment out thye secondary pipeline
Apr 14 11:43:01 app-srv06 logstash[5782]: [2021-04-14T11:43:01,684][ERROR][logstash.javapipeline ][pfelk][Beats] A plugin had an unrecoverable error. Will restart this plugin.
Apr 14 11:43:01 app-srv06 logstash[5782]: Pipeline_id:pfelk
Apr 14 11:43:01 app-srv06 logstash[5782]: Plugin: <LogStash::Inputs::Beats id=>"Beats", type=>"beats", port=>5044, enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_3f021bba-65a0-4d05-863e-6f6248628f8e", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, add_hostname=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>8>
Apr 14 11:43:01 app-srv06 logstash[5782]: Error: Address already in use
Apr 14 11:43:01 app-srv06 logstash[5782]: Exception: Java::JavaNet::BindException
Apr 14 11:43:01 app-srv06 logstash[5782]: Stack: sun.nio.ch.Net.bind0(Native Method)
Apr 14 11:43:01 app-srv06 logstash[5782]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:455)
Apr 14 11:43:01 app-srv06 logstash[5782]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:447)
Apr 14 11:43:01 app-srv06 logstash[5782]: sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:227)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:134)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:550)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1334)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:506)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:491)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:973)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:248)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:356)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:164)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:472)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:500)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.util.concurrent.SingleThreadEventExecutor$4.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:989)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.util.internal.ThreadExecutorMap$2.run(io/netty/util/internal/ThreadExecutorMap.java:74)
Apr 14 11:43:01 app-srv06 logstash[5782]: io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30)
Apr 14 11:43:01 app-srv06 logstash[5782]: java.lang.Thread.run(java/lang/Thread.java:834)
Apr 14 11:43:02 app-srv06 logstash[5782]: [2021-04-14T11:43:02,687][INFO ][org.logstash.beats.Server][pfelk][Beats] Starting server on port: 504
And this continueing logging the same error ????