Unable to configure dead_letter_queue input for logstash

I have configure a path to dead_letter_queue in logstash.yml like this

path.dead_letter_queue: "/var/log/logstash/dead_letter_queue"

And below is the input configuration to read DLQ.

input {
  dead_letter_queue {
    path => "/var/log/logstash/dead_letter_queue"
  }
}

As mentioned in the documentation, separate folder will be created for DLQ os each pipeline and same is happening with me. However, when logstash starts it tries to read from path /var/log/logstash/dead_letter_queue/main and pipeline fails as the path doesn't exists since there is no main pipeline.

How to instruct logstash to read from folders other than main?

Find below the error I'm getting;

[ERROR] 2020-03-03 08:41:19.134 [[dlq]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline_id=>"dlq", :exception=>java.nio.file.NoSuchFileException: /var/log/logstash/dead_letter_queue/main, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:86)", "sun.nio.fs.UnixException.asIOException(sun/nio/fs/UnixException.java:111)", "sun.nio.fs.LinuxWatchService$Poller.implRegister(sun/nio/fs/LinuxWatchService.java:246)", "sun.nio.fs.AbstractPoller.processRequests(sun/nio/fs/AbstractPoller.java:260)", "sun.nio.fs.LinuxWatchService$Poller.run(sun/nio/fs/LinuxWatchService.java:364)", "java.lang.Thread.run(java/lang/Thread.java:748)"], "pipeline.sources"=>["/etc/logstash/conf.d/pipelines/dlq/10_input.conf", "/etc/logstash/conf.d/pipelines/dlq/10_output.conf"], :thread=>"#<Thread:0x3a8580ec run>"}

Hi,

By default it tries to read the data for the main pipeline. This can be changed by setting the pipeline_id: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-dead_letter_queue.html#plugins-inputs-dead_letter_queue-pipeline_id

Best regards
Wolfram

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.