[Solved] Logstash - Pipeline to Pipeline Config

Hi,
I'm trying to make our huge logstash configuration easier readable and flexible and therefore thought of splitting it into several pipelines.
I came across the pipeline to pipeline communication feature:


and also found the pipeline to pipeline communication helpful in our case:
https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html

So I started to setup a basic pipeline configuration with one general input port, which looks as following:

$ cat /opt/elastic/config/logstash_multiple_pipelines/pipelines/pipelines.yml
- pipeline.id: general-input
  path.config: "/opt/elastic/config/logstash_multiple_pipelines/pipelines/general-input.cfg"

$ cat /opt/elastic/config/logstash_multiple_pipelines/pipelines/general-input.cfg
input {
  beats {
port => 5044
  }
}
filter { }
output {
  if [tags] == "ONSH-ES2-Info" {
pipeline { send_to => onsh-es2-info }
  }
  else {
pipeline { send_to => fallback }
  }
}

But it fails during config check or startup with the following error which I quite don't understand:

[FATAL] 2019-09-26 12:34:34.078 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, { at line 9, column 41 (byte 135) after output {
  if [tags] == "ONSH-ES2-Info" {
pipeline { send_to => onsh-es2-info
[ERROR] 2019-09-26 12:34:34.089 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Does anyone know what's the issue on line 9 and column 41?
I don't see any configuration error...

Thanks and regards

I just found the solution to the issue.
It seems that there are no "-" allowed in pipeline names!

- is allowed in pipeline names, but pipeline names should be in double quotes

  pipeline { send_to => "onsh-es2-info" }
1 Like

Oh okay, that pretty much describes it.
But I think then it should also be corrected within the example on:
https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#distributor-pattern

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.