I install Logstash deb file.
MY logstash configuration file like these;
#vim /etc/logstash/conf.d/02-beats-input.conf
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
#vim /etc/logstash/conf.d/10-syslog-filter.conf
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri {}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
#vim /etc/logstash/conf.d/30-elasticsearch-output.conf
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
I load path.config by this command
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --config.test_and_exit
configuration ok.
I try to run logstash with my configuration. I use this command
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/
It shows this error
--- jar coordinate com.fasterxml.jackson.core:jackson-annotations already loaded with version 2.7.1 - omit version 2.7.0
--- jar coordinate com.fasterxml.jackson.core:jackson-databind already loaded with version 2.7.1 - omit version 2.7.1-1
Sending logstash logs to /var/log/logstash/logstash.log.
--- jar coordinate com.fasterxml.jackson.core:jackson-core already loaded with version 2.7.1 - omit version 2.7.5
--- jar coordinate com.fasterxml.jackson.core:jackson-annotations already loaded with version 2.7.1 - omit version 2.7.5
--- jar coordinate com.fasterxml.jackson.core:jackson-databind already loaded with version 2.7.1 - omit version 2.7.5
--- jar coordinate com.fasterxml.jackson.module:jackson-module-afterburner already loaded with version 2.7.1 - omit version 2.7.5
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
An unexpected error occurred! {:error=>#<NoMethodError: undefined method stop' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-3.1.0.beta4-java/lib/logstash/inputs/beats.rb:173:instop'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:88:in do_stop'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:366:in shutdown'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:252:instop_pipeline'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:261:in shutdown_pipelines'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:261:in shutdown_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:123:inshutdown'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:237:in execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:157:in run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:inrun'", "/usr/share/logstash/lib/bootstrap/environment.rb:66:in `(root)'"], :level=>:fatal}
for this main pipeline doesn't start.