Sample setting with elasticsearch input plugin doesn't work

Elastic Stack Logstash
1

A sample setting on https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html may not work.

  • Sample
    input {
    elasticsearch {
    hosts => "es.production.mysite.org"
    index => "mydata-2018.09."
    query => "    "
    size => 500
    scroll => "5m"
    docinfo => true
    }
    }

  • Version: logstash 5.4.0

  • Operating System: macOS Sierra 10.12.4

  • Config File (if you have sensitive info, please remove it):

    input{
    elasticsearch{
    hosts => "localhost"
    index => "packetbeat-"
    user => "elastic"
    password => "changeme"
    query => '    '
    }
    }
    filter{}
    output{
    file{
    path => "/Users/SHIN/Elastic/Elastic5.4/logstash-5.4.0/test.out"
    }
    }

  • Error Message:
    Error: [500] {"error":{"root_cause":[{"type":"json_parse_exception","reason":"Unexpected character ('' (code 42)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@5d974f5e; line: 1, column: 2]"}],"type":"json_parse_exception","reason":"Unexpected character ('' (code 42)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@5d974f5e; line: 1, column: 2]"},"status":500}

1 Like
2

just had the same error

remove the line " query => '*' "all should be good :slight_smile:

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.