Hello elastic community,
I'm very new to the ELK stack and am working on getting a production environment up and running. So far I have a four node Elasticsearch cluster running with Kibana. Everything there is working but I cannot get Logstash to start. I have been searching through documentation at elastic.co and here in the forums.
If I messed up anything in this post with posting code, please let me know.
This is all in a virtual servers environment on several Windows Server 2019 VMs.
I'm running Java JDK 14.
Here is where I am at with logstash:
I cannot get Logstash to start with nssm.exe/ Windows Services NO MATTER WHAT.
I cannot get Logstash to start with argument -f path/to/logstash.yml from CLI
I can get Logstash to start with argument -f path/to/logstash.conf from CLI
I can get Logstash to start with no argument from CLI
From the command line I get the following errors at the end when using the -f path/to/logstash.yml argument:
[FATAL] 2020-12-09 11:16:22.596 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of [ \t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)
[ERROR] 2020-12-09 11:16:22.779 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
I'm sure my issue is with my logstash.yml but I'm not sure what the problem is. All help is greatly appreciated.
Here is all the info about the code and errors:
NSSM
Version: 2.24-101-g897c7ad 64bit, 2017-04-26
NSSM service editor
Application Tab
- Path: C:\ProgramData\ELKStask\logstash-7.9.2\bin\logstash.bat
- Startup directory: C:\ProgramData\ELKStask\logstash-7.9.2\bin\
- Arguments: -f C:\ProgramData\ELKstack\logstash-7.9.2\config\logstash.yml
Error message when trying to start the Logstash services in Windows Services:
Services
Windows could not start the Logstash 7.9.2 Windows service
(logstash-services-x64) service on Local Computer.
The service did not return an error. This could be an Internal
Windows error or an internal service error.
If the problem persists, contact your system administrator.
After I click "OK" on the error the service status goes to the "Paused" state and Logstash is not started.
Here are my configs:
Logstash.yml
Note: config.debug and log.level debug are on for testing right now. Those will be removed once everything is working.
path.config: C:\ProgramData\ELKStack\logstash-7.9.2\config\logstash.conf
node.name: NODE.NAME
path.data: G:\data
config.debug: true
log.level: debug
path.logs: G:\logs
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: "elastic"
xpack.monitoring.elasticsearch.password: "PASSWORD"
xpack.monitoring.elasticsearch.hosts: ['https://SERVER.NAME.COM:9200']
xpack.monitoring.elasticsearch.ssl.certificate_authority: C:\ProgramData\ElkStack\logstash-7.9.2\config\elastic-stack-ca.crt
xpack.monitoring.elasticsearch.ssl.verification_mode: none
Logstash.conf
input {
beats {
port => 5044
ssl => true
ssl_certificate => "C:\ProgramData\ELKStack\logstash-7.9.2\config\logstash.crt"
ssl_key => "C:\ProgramData\Elkstack\logstash-7.9.2\config\logstash.pkcs8.key"
}
}
output {
elasticsearch {
hosts => "https://SERVER.NAME.COM:9200"
ssl => true
cacert => "C:\ProgramData\ELKStack\logstash-7.9.2\config\elastic-stack-ca.crt"
ssl_certificate_verification => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
user => "elastic"
password => "PASSWORD"
}
}
Command Line Error in next commit.