PFB my configuration file : input
{
dead_letter_queue
{
path => "E:\elk-8.14\elkerrors\QA\FullIndex"
commit_offsets => true
pipeline_id => "main"
}
dead_letter_queue
{
path => "E:\elk-8.14\elkerrors\QA\IncrementalIndex"
commit_offsets => true
pipeline_id => "main"
}
dead_letter_queue
{
path => "E:\elk-8.14\elkerrors\QA\FieldAddition"
commit_offsets => true
pipeline_id => "main"
}
dead_letter_queue
{
path => "E:\elk-8.14\elkerrors\QA\PartyAddition"
commit_offsets => true
pipeline_id => "main"
}
}
filter {
ruby {
code => "event.set('failed_message', event.to_json())"
}
prune {
whitelist_names => [ "^failed_message$" ]
}
json
{
source =>"failed_message"
}
mutate {
add_field => {
"message" => "%{[@metadata][dead_letter_queue][reason]}"
}
}
}
output
{
stdout{}
elasticsearch{
hosts => ["xxxxxxxx"]
user => "xxx"
password => "xxxxxxxx"
cacert => 'xxxxx'
}
}
BUt getting below error
[ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (RuntimeError) \n\n\tyou might need to reinstall the gem which depends on the missing jar or in case there is Jars.lock then resolve the jars with lock_jars
command\n\nno such file to load -- co/elastic/logstash/input/logstash-input-dead_letter_queue/2.0.0/logstash-input-dead_letter_queue-2.0.0.jar (LoadError)", :backtrace=>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:120)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1363)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1336)", "org.jruby.ir.targets.indy.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:30)", "F_3a_.ELK_8_dot_14_Software.logstash_minus_8_dot_14_dot_2_minus_windows_minus_x86_64.logstash_minus_8_dot_14_dot_2.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(F:/ELK_8.14_Software/logstash-8.14.2-windows-x86_64/logstash-8.14.2/logstash-core/lib/logstash/java_pipeline.rb:48)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:139)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:112)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", "org.jruby.RubyClass.newInstance(RubyClass.java:949)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.indy.InvokeSite.performIndirectCall(InvokeSite.java:735)", "org.jruby.ir.targets.indy.InvokeSite.invoke(InvokeSite.java:657)", "F_3a_.ELK_8_dot_14_Software.logstash_minus_8_dot_14_dot_2_minus_windows_minus_x86_64.logstash_minus_8_dot_14_dot_2.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(F:/ELK_8.14_Software/logstash-8.14.2-windows-x86_64/logstash-8.14.2/logstash-core/lib/logstash/pipeline_action/create.rb:49)", "F_3a_.ELK_8_dot_14_Software.logstash_minus_8_dot_14_dot_2_minus_windows_minus_x86_64.logstash_minus_8_dot_14_dot_2.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$VARARGS(F:/ELK_8.14_Software/logstash-8.14.2-windows-x86_64/logstash-8.14.2/logstash-core/lib/logstash/pipeline_action/create.rb:48)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:139)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:112)", "org.jruby.ir.targets.indy.InvokeSite.performIndirectCall(InvokeSite.java:735)", "org.jruby.ir.targets.indy.InvokeSite.invoke(InvokeSite.java:657)", "F_3a_.ELK_8_dot_14_Software.logstash_minus_8_dot_14_dot_2_minus_windows_minus_x86_64.logstash_minus_8_dot_14_dot_2.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(F:/ELK_8.14_Software/logstash-8.14.2-windows-x86_64/logstash-8.14.2/logstash-core/lib/logstash/agent.rb:386)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:141)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:64)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:144)", "org.jruby.RubyProc.call(RubyProc.java:354)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)", "java.base/java.lang.Thread.run(Thread.java:840)"]}
[2024-11-05T01:17:33,434][INFO ][logstash.runner ] Logstash shut down.
[2024-11-05T01:17:33,460][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit