Problem in Logstash Starting


#1

HI Team,

Actually i am suffering a issue in pushing data from Filebeat to logstash.
After trying to run the logstash,Logstash does not give any Error but PIpeLine is not Starting.Here is the output of logstash after starting.

[root@MUMCHELK01 ~]# cd /opt/READONLYREST/OSS/logstash-6.3.0/
[root@MUMCHELK01 logstash-6.3.0]# bin/logstash -f /opt/READONLYREST/OSS/logstash                                                                                                                                                             -6.3.0/cap_are_common_logstash.conf
Sending Logstash's logs to /opt/READONLYREST/OSS/logstash-6.3.0/logs which is now configured via log4j2.properties
[2018-07-04T19:41:13,750][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-04T19:41:14,314][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.3.0"}
[2018-07-04T19:41:15,294][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 34, column 7 (byte 565) after output {\n\nif [fields][log_type] == \"cap_uat_demo\"{\n\nstdout {}\n\n  \nelasticsearch {\n      \n\n      hosts => \"172.21.153.176:9200\"\n      index => \"index2\"\n      user => c-ajitb\n      ", :backtrace=>["/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}
[2018-07-04T19:41:15,586][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[root@MUMCHELK01 logstash-6.3.0]#

and Configuration File is:

input {
  beats {
      port => 5044
  }
}
filter {
    ruby {
        code => "
            fieldArray = event.get('message').split('> <')
            for field in fieldArray
                field = field.delete '<'
                field = field.delete '>'
                result = field.split(': ')
                event.set(result[0], result[1])
            end
        "
    }

}

output {

if [fields][log_type] == "cap_uat_demo"{

stdout {}

  
elasticsearch {
      

      hosts => "172.21.143.136:9200"
      index => "index2"
      user =>ajitb
      password => pass#1234
      ssl => true
      ssl_certificate_verification => false
      truststore => "/opt/READONLYREST/elasticsearch-6.3.0/config/keystore.jks"
      truststore_password =>readonlyrest

     }
   }
}

#2

user, password, and truststore_password have to be quoted. For example,

user => "ajitb"

#3

Hi @Badger,

Thanks for the Quick Response.
After Giving the username,password and truststore in double quota the Error is:

[2018-07-04T20:05:33,483][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://ajitb:xxxxxx@172.21.153.176:9200/, :path=>"/"}
[2018-07-04T20:05:33,493][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://ajitb:xxxxxx@172.21.153.176:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'https://172.21.153.176:9200/'"}
[2018-07-04T20:05:38,495][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://ajitb:xxxxxx@172.21.153.176:9200/, :path=>"/"}
[2018-07-04T20:05:38,506][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://ajitb:xxxxxx@172.21.153.176:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'https://172.21.153.176:9200/'"}

#4

Is there an error message in the elasticsearch logs that corresponds to those warnings?


#5

Hi @Badger,

After One Transaction with my application and once after pushing data from filebeat to logstash,
logstash automatically stopped and throw an Exception.
Below is the Log-

An unexpected error occurred! {:error=>#<NoMethodError: undefined method `<' for nil:NilClass>, :backtrace=>["/opt/READONLYREST/OSS/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:222:in `get_event_type'", "/opt/READONLYREST/OSS/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:47:in `event_action_tuple'", "/opt/READONLYREST/OSS/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:36:in `block in multi_receive'", "org/jruby/RubyArray.java:2486:in `map'", "/opt/READONLYREST/OSS/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:36:in `multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:109:in `multi_receive'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:156:in `multi_receive'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:475:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in `each'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:474:in `output_batch'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'", "/opt/READONLYREST/OSS/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:384:in `block in start_workers'"]}
[2018-07-05T11:29:09,273][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

#6

Hi @Badger,
issue is Resolved,there is a minor mistake(putting Wrong UserName which is not authenticated by kibana and ES).


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.