Not able to execute simple logstash command mentioned in the documentation


(Alok Kumar) #1

Hi, i am new to Logstash and while trying examples mentioned in the documentation, for learning purpose both Logstash1.5.3 and Elasticsearch 1.7.1 are on same machine. I am getting below warning and issue.

Command used: bin/logstash -f logstash-filter.conf
output: '[DEPRECATED] use require 'concurrent' instead of require 'concurrent_ruby'
[2015-08-19 05:01:22.323] WARN -- Concurrent: [DEPRECATED] Java 7 is deprecated, please use Java 8.
Java 7 support is only best effort, it may not work. It will be removed in next release (1.0).
Logstash startup completed

{
"message" => "127.0.0.1 - - [11/Dec/2013:00:01:45 -0800] "GET /xampp/status.php HTTP/1.1" 200 3891 "http://cadenza/xampp/navi.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0"",
"@version" => "1",
"@timestamp" => "2013-12-11T08:01:45.000Z",
"host" => "localhost",
"clientip" => "127.0.0.1",
"ident" => "-",
"auth" => "-",
"timestamp" => "11/Dec/2013:00:01:45 -0800",
"verb" => "GET",
"request" => "/xampp/status.php",
"httpversion" => "1.1",
"response" => "200",
"bytes" => "3891",
"referrer" => ""http://cadenza/xampp/navi.php"",
"agent" => ""Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0""
}

It simply hangs after this and after 5 mins when I give Ctrl+C, I get the following messages which does not stops:

["INFLIGHT_EVENTS_REPORT", "2015-08-19T05:04:52-04:00", {"input_to_filter"=>0, "filter_to_output"=>0, "outputs"=>[]}] {:level=>:warn}
Received shutdown signal, but pipeline is still waiting for in-flight events
to be processed. Sending another ^C will force quit Logstash, but this may cause
data loss. {:level=>:warn}
["INFLIGHT_EVENTS_REPORT", "2015-08-19T05:04:57-04:00", {"input_to_filter"=>0, "filter_to_output"=>0, "outputs"=>[]}] {:level=>:warn}
["INFLIGHT_EVENTS_REPORT", "2015-08-19T05:05:02-04:00", {"input_to_filter"=>0, "filter_to_output"=>0, "outputs"=>[]}] {:level=>:warn}
["INFLIGHT_EVENTS_REPORT", "2015-08-19T05:05:07-04:00", {"input_to_filter"=>0, "filter_to_output"=>0, "outputs"=>[]}] {:level=>:warn}

Config file used is:
input { stdin { } }

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}

output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}

Input is:
127.0.0.1 - - [11/Dec/2013:00:01:45 -0800] "GET /xampp/status.php HTTP/1.1" 200 3891 "http://cadenza/xampp/navi.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0"

All I am doing is copy pasting the example mentioned in https://www.elastic.co/guide/en/logstash/current/config-examples.html . Feels bad that even i cant get this replayed.

I am sure something is not correct and I need some expert help.


(system) #2