# My "Logstash.conf" gives errors

**URL:** <https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041>\
**Category:** Logstash\
**Created:** [June 12, 2017, 12:55pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041 "2017-06-12T12:55:39Z")\
**Posts on this page:** 13\
**Page:** 2

<div class="post-metadata">

**Author:** ![MartinNouv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinnouv/32/18995_2.png) [@MartinNouv](https://discuss.elastic.co/u/MartinNouv)\
**Post date:** [June 16, 2017, 8:27am UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/21 "2017-06-16T08:27:24Z")

</div>

```
Error registering pl
ugin {:plugin=>"#<LogStash::OutputDelegator:0x3e8d2e9a @namespaced_metric=#<LogS
tash::Instrument::NamespacedMetric:0x32688caf @metric=#<LogStash::Instrument::Me
tric:0x59c15491 @collector=#<LogStash::Instrument::Collector:0x7b4256fa @agent=n
il, @metric_store=#<LogStash::Instrument::MetricStore:0x2cec4ef6 @store=#<Concur
rent::Map:0x5a97a230 @default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x9a10
02f>, @fast_lookup=#<Concurrent::Map:0x60bd6267 @default_proc=nil>>>>, @namespac
e_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"054d561825a4f8783748d6
1689ac18c5fefe4b96-4\"]>, @metric=#<LogStash::Instrument::NamespacedMetric:0x490
9bab7 @metric=#<LogStash::Instrument::Metric:0x59c15491 @collector=#<LogStash::I
nstrument::Collector:0x7b4256fa @agent=nil, @metric_store=#<LogStash::Instrument
::MetricStore:0x2cec4ef6 @store=#<Concurrent::Map:0x5a97a230 @default_proc=nil>,
 @structured_lookup_mutex=#<Mutex:0x9a1002f>, @fast_lookup=#<Concurrent::Map:0x6
0bd6267 @default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plug
ins, :outputs]>, @logger=#<LogStash::Logging::Logger:0x430d86f9 @logger=#<Java::
OrgApacheLoggingLog4jCore::Logger:0x5121d097>>, @strategy=#<LogStash::OutputDele
gatorStrategies::Shared:0x29083d34 @output=<LogStash::Outputs::ElasticSearch hos
ts=>[https://127.0.0.1:9200], index=>\"csv_index\", id=>\"054d561825a4f8783748d6
1689ac18c5fefe4b96-4\", enable_metric=>true, codec=><LogStash::Codecs::Plain id=
>\"plain_3f5da417-a002-4fff-a680-96ef558f619d\", enable_metric=>true, charset=>\
"UTF-8\">, workers=>1, manage_template=>true, template_name=>\"logstash\", templ
ate_overwrite=>false, idle_flush_time=>1, doc_as_upsert=>false, script_type=>\"i
nline\", script_lang=>\"painless\", script_var_name=>\"event\", scripted_upsert=
>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1,
 action=>\"index\", ssl_certificate_verification=>true, sniffing=>false, sniffin
g_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, healthcheck_pa
th=>\"/\", absolute_healthcheck_path=>false, sniffing_path=>\"_nodes/http\", abs
olute_sniffing_path=>false, resurrect_delay=>5, validate_after_inactivity=>10000
, ssl=>true>>, @id=\"054d561825a4f8783748d61689ac18c5fefe4b96-4\", @metric_event
s=#<LogStash::Instrument::NamespacedMetric:0x22f5ada7 @metric=#<LogStash::Instru
ment::Metric:0x59c15491 @collector=#<LogStash::Instrument::Collector:0x7b4256fa
@agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x2cec4ef6 @store=
#<Concurrent::Map:0x5a97a230 @default_proc=nil>, @structured_lookup_mutex=#<Mute
x:0x9a1002f>, @fast_lookup=#<Concurrent::Map:0x60bd6267 @default_proc=nil>>>>, @
namespace_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"054d561825a4f8
783748d61689ac18c5fefe4b96-4\", :events]>, @output_class=LogStash::Outputs::Elas
ticSearch>", :error=>"Unrecognized SSL message, plaintext connection?"}
[2017-06-16T10:13:43,038][ERROR][logstash.agent] Pipeline aborted due
 to error {:exception=>#<Manticore::UnknownException: Unrecognized SSL message,
plaintext connection?>, :backtrace=>["C:/Utilisateurs/A645234/Documents/logstash
-5.4.0/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/response.
rb:37:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "C:/Utilisateur
s/A645234/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-
java/lib/manticore/response.rb:79:in `call'", "C:/Utilisateurs/A645234/Documents
/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0
-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:70:in
`perform_request'", "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/vendor/bun
dle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs
/elasticsearch/http_client/pool.rb:285:in `perform_request_to_url'", "C:/Utilisa
teurs/A645234/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-out
put-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool
.rb:253:in `healthcheck!'", "org/jruby/RubyHash.java:1342:in `each'", "C:/Utilis
ateurs/A645234/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-ou
tput-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/poo
l.rb:243:in `healthcheck!'", "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/v
endor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstas
h/outputs/elasticsearch/http_client/pool.rb:335:in `update_urls'", "C:/Utilisate
urs/A645234/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-outpu
t-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.r
b:72:in `start'", "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/vendor/bundl
e/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/e
lasticsearch/http_client.rb:264:in `build_pool'", "C:/Utilisateurs/A645234/Docum
ents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6
.3.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:58:in `initialize'",
 "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/
logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http
_client_builder.rb:82:in `build'", "C:/Utilisateurs/A645234/Documents/logstash-5
.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/l
ogstash/outputs/elasticsearch.rb:225:in `build_client'", "C:/Utilisateurs/A64523
4/Documents/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elastics
earch-6.3.0-java/lib/logstash/outputs/elasticsearch/common.rb:20:in `register'",
 "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/logstash-core/lib/logstash/ou
tput_delegator_strategies/shared.rb:9:in `register'", "C:/Utilisateurs/A645234/D
ocuments/logstash-5.4.0/logstash-core/lib/logstash/output_delegator.rb:41:in `re
gister'", "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/logstash-core/lib/lo
gstash/pipeline.rb:268:in `register_plugin'", "C:/Utilisateurs/A645234/Documents
/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:279:in `register_plugins'
", "org/jruby/RubyArray.java:1613:in `each'", "C:/Utilisateurs/A645234/Documents
/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:279:in `register_plugins'
", "C:/Utilisateurs/A645234/Documents/logstash-5.4.0/logstash-core/lib/logstash/
pipeline.rb:288:in `start_workers'", "C:/Utilisateurs/A645234/Documents/logstash
-5.4.0/logstash-core/lib/logstash/pipeline.rb:214:in `run'", "C:/Utilisateurs/A6
45234/Documents/logstash-5.4.0/logstash-core/lib/logstash/agent.rb:398:in `start
_pipeline'"]}
```

---

<div class="post-metadata">

**Author:** ![MartinNouv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinnouv/32/18995_2.png) [@MartinNouv](https://discuss.elastic.co/u/MartinNouv)\
**Post date:** [June 19, 2017, 7:36am UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/22 "2017-06-19T07:36:26Z")

</div>

Anyone ?

---

<div class="post-metadata">

**Author:** ![prosenjit](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@prosenjit](https://discuss.elastic.co/u/prosenjit)\
**Post date:** [June 19, 2017, 1:09pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/23 "2017-06-19T13:09:18Z")

</div>

the option **host** in deprecated in elastic 5.x and versions above. Can you try using **hosts** instead in the output section of your logstash conf file??

---

<div class="post-metadata">

**Author:** ![MartinNouv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinnouv/32/18995_2.png) [@MartinNouv](https://discuss.elastic.co/u/MartinNouv)\
**Post date:** [June 19, 2017, 1:26pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/24 "2017-06-19T13:26:04Z")

</div>

It was one of my errors yeah. It's all good now.

---

<div class="post-metadata">

**Author:** ![Ranjith\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ranjith_m/32/19272_2.png) [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Post date:** [June 19, 2017, 3:15pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/25 "2017-06-19T15:15:29Z")

</div>

> [@alanr4](#):
>
> [2017-06-14T15:11:13,598][ERROR][logstash.inputs.file] Unknown setting 'user' for file  
> [2017-06-14T15:11:13,601][ERROR][logstash.inputs.file] Unknown setting 'password' for file  
> [2017-06-14T15:11:13,608][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Something is wrong with your configuration."}

Can you share your config file, you should have added username and password for elasticsearch output, because x-pack is installed. You probably need to verify there.

---

<div class="post-metadata">

**Author:** ![alanr4](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@alanr4](https://discuss.elastic.co/u/alanr4)\
**Post date:** [June 19, 2017, 4:43pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/26 "2017-06-19T16:43:15Z")

</div>

Hello Ranjith\_M, thanks for your attention.

I configured my file (.conf) according to that explanation.  
[Https://www.elastic.co/guide/en/x-pack/current/logstash.html](Https://www.elastic.co/guide/en/x-pack/current/logstash.html)

Here's my .conf file:

input {  
#stdin { }  
file {  
path =\> '/var/log/glassfish/domain1/server.log'  
user =\> "logstash\_internal"  
password =\> "changeme"  
type =\> 'server'  
start\_position =\> 'beginning'  
}  
}

filter {  
user =\> "logstash\_internal"  
password =\> "changeme"  
if [type] == "server" and "TRACKER" in [message] {  
grok{  
match =\> { "message" =\> "%{ONETRACKER}"}  
}  
}  
if [type] == "server" and "LOGIN" in [message] {  
grok{  
match =\> { "message" =\> "%{ONETLOGIN}"}  
}  
}  
if [type] == "server" and "LOGOUT" in [message] {

```
                            grok{
                                 match => { "message" => "%{ONETLOGOUT}"}
                                 }
                            }
    if [type] == "server" and "VIEW" in [message] {

                            grok{
                                 match => { "message" => "%{ONETVIEW}"}
                                 }
                            }
    if [type] == "server" and "LOG" in [message] {

                            grok{
                                 match => { "message" => "%{ONETLOG}"}
                                 }
                            }
    if [type] == "server" and "MAP" and "num_operator:1" in [message] {

                            grok{
                                 match => { "message" => "%{ONETMAPA}"}
                                 }
                            }

   if [type] == "server" and "MAP" in [message] and "num_operator:1" not in [message] {

                            grok{
                                 match => { "message" => "%{ONETMAPAPLUS}"}
                                 }
                            }

```

geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
mutate {  
remove\_tag =\> ["\_grokparsefailure"]  
}  
}  
output {  
elasticsearch { hosts =\> ["localhost:XX"]  
user =\> "logstash\_internal"  
password =\> "changeme"  
index =\> "logstash-web01-%{+YYYY.MM.dd}" }  
#stdout { codec =\> rubydebug }  
}

Note:  
Without xpacode, it works normally.

---

<div class="post-metadata">

**Author:** ![Ranjith\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ranjith_m/32/19272_2.png) [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Post date:** [June 19, 2017, 9:06pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/27 "2017-06-19T21:06:53Z")

</div>

> [@alanr4](#):
>
> user =\> "logstash\_internal"  
> password =\> "changeme"

User and password configs are not part of logstash file input plugin.  
Below is the link for valid configs.

> **[File input plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html)**

---

<div class="post-metadata">

**Author:** ![alanr4](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@alanr4](https://discuss.elastic.co/u/alanr4)\
**Post date:** [June 20, 2017, 12:55pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/28 "2017-06-20T12:55:30Z")

</div>

> [@alanr4](#):
>
> [Https://www.elastic.co/guide/en/x-pack/current/logstash.htm](Https://www.elastic.co/guide/en/x-pack/current/logstash.htm)

Ranjith\_M, thanks for the feedback.  
Please, look at the 3 in this explanation, My problem occurs after installing the x-pac plugin.

---

<div class="post-metadata">

**Author:** ![Ranjith\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ranjith_m/32/19272_2.png) [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Post date:** [June 20, 2017, 1:36pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/29 "2017-06-20T13:36:20Z")

</div>

Hi Alanr,

Agree with what you said, but that is for logstash level security, and user name and password shouldn't be with in file properties.

file {  
path =\> "/tmp/access\_log"  
start\_position =\> "beginning"  
}

From the above snippet, what ever you keep in the braces are specific properties to file type and that doesn't have user and password as configs, instead it should be as below

input {  
file {  
path =\> "/tmp/access\_log"  
start\_position =\> "beginning"  
}  
user: xxx  
password: yyy  
}

Please let me know if you still face issues.

---

<div class="post-metadata">

**Author:** ![alanr4](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@alanr4](https://discuss.elastic.co/u/alanr4)\
**Post date:** [June 22, 2017, 1:43pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/30 "2017-06-22T13:43:25Z")

</div>

Hello Ranjith\_M

I tried configuring the file (.conf) as you instructed me, but after setting the logstash service did not work.

Searching the internet, I found this link ([https://github.com/elastic/logstash/issues/6332](https://github.com/elastic/logstash/issues/6332)), after following the tips of this topic (configuring only authentication for output) the service logstash returned to work, but did not generate the indices No elastic / kibana!

In short, I'm still having problems after installing x-pac.

---

<div class="post-metadata">

**Author:** ![Ranjith\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ranjith_m/32/19272_2.png) [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Post date:** [June 22, 2017, 2:27pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/31 "2017-06-22T14:27:24Z")

</div>

@alanr4

I will test your scenario some time today and will let you know. Mean while to understand clearly, sharing your conf( **Change your actual details** ) will help.  
Also what version of elastic/logstash you are using?

---

<div class="post-metadata">

**Author:** ![alanr4](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@alanr4](https://discuss.elastic.co/u/alanr4)\
**Post date:** [June 22, 2017, 5:39pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/32 "2017-06-22T17:39:30Z")

</div>

Hi Ranjith\_M

Follows the original (.conf) file

input {  
#stdin { }  
file {  
path =\> '/var/log/onet/reportLog.log\*'  
type =\> 'report'  
start\_position =\> 'beginning'  
}  
}

filter {  
if [type] == "report" and "TRACKER" in [message] {  
grok{  
match =\> { "message" =\> "%{ONETRACKER}"}  
}  
}  
if [type] == "report" and "LOGIN" in [message] {  
grok{  
match =\> { "message" =\> "%{ONETLOGIN}"}  
}  
}  
if [type] == "report" and "LOGOUT" in [message] {

```
                            grok{
                                 match => { "message" => "%{ONETLOGOUT}"}
                                 }
                            }
    if [type] == "report" and "VIEW" in [message] {

                            grok{
                                 match => { "message" => "%{ONETVIEW}"}
                                 }
                            }
    if [type] == "report" and "LOG" in [message] {

                            grok{
                                 match => { "message" => "%{ONETLOG}"}
                                 }
                            }
    if [type] == "report" and "MAP" and "num_operator:1" in [message] {

                            grok{
                                 match => { "message" => "%{ONETMAPA}"}
                                 }
                            }

   if [type] == "report" and "MAP" in [message] and "num_operator:1" not in [message] {

                            grok{
                                 match => { "message" => "%{ONETMAPAPLUS}"}
                                 }
                            }

```

geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
mutate {  
remove\_tag =\> ["\_grokparsefailure"]  
}  
}  
output {  
elasticsearch { hosts =\> ["200.98.233.36:9333"]  
index =\> "logstash-lab-%{+YYYY.MM.dd}"  
user =\> "logstash\_internal"  
password =\> "123456"  
#stdout { codec =\> rubydebug }  
}  
}

In the file (logstash.yml) was added the parameters:

xpack.monitoring.enabled:  
xpack.monitoring.elasticsearch.url: ["[http://200.98.233.36:9333](http://200.98.233.36:9333)"]  
xpack.monitoring.elasticsearch.username: "logstash\_system"  
xpack.monitoring.elasticsearch.password: "123456"

Note:

- the default port on my elasticsearc, which is running in docker, has been changed.
- Without the xpac plugin, it works normal
- At the moment it is not generating any errors in the logs (logstash, elasticsearch)
- Versions (kibana, elastic, logstash) 5.4.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 5:39pm UTC](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041/33 "2017-07-20T17:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/my-logstash-conf-gives-errors/89041.md?page=1)