Trouble sending logs to Logstash from Filebeat - Pipeline error recieved

Elastic Stack Beats
1

Hi there, pretty new to the Elastic Stack and I keep getting an error when trying to set up Filebeats and Logstash to work together.

Error:
<
'''
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#
", "=>" at line 13, column 10 (byte 255) after output {\n\telasticsearch {\n\t\thosts => "http://192.168.0.26:9200"\n\t\tmanage_template => false\n\t\tindex => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"\n\t\tpipeline => "%{[@metadata][pipeline]}"\n\t\tstdout ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in block in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}
'''
/>

I cannot make heads no tails as to what this error is trying to tell me or what I have done wrong.

My logstash.conf file looks like so:

<
'''
input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => "http://192.168.0.26:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
stdout {
codec => rubydebug
}
}
}
'''
/>

Any and all help would be greatly appreciated.

2

Hi!

Since this is a Logstash error I would suggest you to try your question on Logstash forum so as to find experts there to cover you. At this point I don't think it has to do with Filebeat at all.

Thank you!

3

My apologies! I'll be more mindful of this in the future.

I also believe I found the solution anyway. I believe the issue was that I has "http://" within the "host" section of the Ealsticsearch output.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.