HI Team,
Actually i am suffering a issue in pushing data from Filebeat to logstash.
After trying to run the logstash,Logstash does not give any Error but PIpeLine is not Starting.Here is the output of logstash after starting.
[root@MUMCHELK01 ~]# cd /opt/READONLYREST/OSS/logstash-6.3.0/
[root@MUMCHELK01 logstash-6.3.0]# bin/logstash -f /opt/READONLYREST/OSS/logstash -6.3.0/cap_are_common_logstash.conf
Sending Logstash's logs to /opt/READONLYREST/OSS/logstash-6.3.0/logs which is now configured via log4j2.properties
[2018-07-04T19:41:13,750][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-04T19:41:14,314][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.3.0"}
[2018-07-04T19:41:15,294][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 34, column 7 (byte 565) after output {\n\nif [fields][log_type] == \"cap_uat_demo\"{\n\nstdout {}\n\n \nelasticsearch {\n \n\n hosts => \"172.21.153.176:9200\"\n index => \"index2\"\n user => c-ajitb\n ", :backtrace=>["/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-04T19:41:15,586][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[root@MUMCHELK01 logstash-6.3.0]#
and Configuration File is:
input {
beats {
port => 5044
}
}
filter {
ruby {
code => "
fieldArray = event.get('message').split('> <')
for field in fieldArray
field = field.delete '<'
field = field.delete '>'
result = field.split(': ')
event.set(result[0], result[1])
end
"
}
}
output {
if [fields][log_type] == "cap_uat_demo"{
stdout {}
elasticsearch {
hosts => "172.21.143.136:9200"
index => "index2"
user =>ajitb
password => pass#1234
ssl => true
ssl_certificate_verification => false
truststore => "/opt/READONLYREST/elasticsearch-6.3.0/config/keystore.jks"
truststore_password =>readonlyrest
}
}
}