Problem running WMI plugin

Elastic Stack Logstash
1

Hi all ,

I am trying to use logstash-input-wmi version 3.0 with logstash 2.4.0 on a Windows Server 2012r2.

I have downloaded the Gem file and ran the logstash-plugin install script, it ran fine, when I run logstash-plugin list, logstash-input-wmi appears on the list.

Now when I run the test, I get the following error:
Settings: Default pipeline workers: 4
←[31mPipeline aborted due to error {:exception=>"NoMethodError", :backtrace=>
["C:/ELK-Stack/logstash/vendor/local_gems/e7f205b3/logstash-input-wmi-3.0.0-java/lib/logstash/inputs/wmi.rb:65:in register'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:330:instart_inputs'",
"org/jruby/RubyArray.java:1613:in each'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:329:instart_inputs'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:180:in start_workers'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:136:inrun'",
"C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:491:in `start_pipeline'"], :level=>:error}←[0m

Any ideas?

Thanks in advance,

Francois

2

It is sad to see that there is not much support for that plugin. Did try it on different windows host, always got the same error.

It seem to point to the socket method, I wish I was more fluent in programming.

3

can you post your configuration? it seems that since remote connection was introduced, when host is not localhost/127.0.0.1/etc it assumes you have credentials like username and password.
But since password isn't mandatory, the code can crash asking for the password value (see line 65 at https://github.com/logstash-plugins/logstash-input-wmi/blob/master/lib/logstash/inputs/wmi.rb#L59-L66)

4

Hi João,

I invoke logstash with the following command:

logstash\bin>logstash -f wmi.config

The config file:

input {
wmi {
query => "select * from Win32_Process"
interval => 10
}
}
output {
stdout {}
}

It looks like the socket function is not returning anything, did test with

@host = Socket.gethostname
@logger.info("this is my host: ", @host)

And it returned nothing.

Logstash is running locally, ping with 127.0.0.1 or localhost or ::1, works ok.

I tried the WMI plugin on Win2k 2 server and Windows 7 on a laptop with the same results.

Thanks in advance,

François