New logstash 6.6 fail to start

[yossiv]

Hi Guys,
i have new logstash installed. but for some reason it faile to start.
1 input and output ( the input and output works fine to my on other logstash system i have)
plugin were installed already

appreciate your help

[warkolm (Mark Walkom)]

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them

[yossiv]

[2019-02-03T17:53:45,087][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-02-03T17:54:07,172][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.6.0"}
[2019-02-03T17:54:08,418][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 37, column 2 (byte 982) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}
[2019-02-03T17:54:08,658][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

[Christian_Dahlqvist]

It seems like you have an issue at line 37 in your config, so it would help you could show it.

[yossiv]

i dont think this related to the input conf. i fix it and same thing it fails on the same errors

Read all documents from Elasticsearch matching the given query

elasticsearch {
tags => ["AWS"]
hosts => "10.120.55.80:9200"
index => "graylog_"
schedule => "/5 * * * *"
query => '{
"query": {
"bool": {
"must": [
{
"query_string": {
"default_field": "F5_RequestStats",
"fields": [
"Profit"
],
"query": " (K2_GameAction:ProcessSlotMachine AND F5_ResponseCode:200) "
}
}
],
"filter": {
"range": {
"timestamp": {
"gte": "now-3m/m",
"lt": "now/m"
}
}
}
}
}
}'
}
}

[Badger]

The configuration you posted is only 34 lines, so it is hard to say what logstash objected to at line 37. However, given that it does not print any configuration where it says 'after "' my guess would be an extra trailing } in the file.

schedule => "*/5 "

That is not a valid schedule.

[yossiv]

please see above it fixed,
but still same error
[2019-02-03T23:17:20,423][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-02-03T23:17:47,908][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.6.0"}
[2019-02-03T23:17:49,087][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 37, column 2 (byte 982) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}

[Badger]

You need to show us all 37 lines of the configuration. Select the text in the edit pane and click on </> in the tool bar above to quote it so that formatting is retained.

[yossiv]

Hi guys,
all good , i was missing "output" command at output file
we can close this issue