Unable to configure plugins for *.log

I am a newbie to ELK. was trying to upload log files to Elasticsearch using logstash encounter below error message.

    > Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:100)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:60)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1156)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1143)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "Users.znrind_minus_a0053.Documents.elasticsearch.logstash_minus_7_dot_4_dot_0.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/Users/znrind-a0053/Documents/elasticsearch/logstash-7.4.0/logstash-core/lib/logstash/java_pipeline.rb:26)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.java:915)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)", "Users.znrind_minus_a0053.Documents.elasticsearch.logstash_minus_7_dot_4_dot_0.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/Users/znrind-a0053/Documents/elasticsearch/logstash-7.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:36)", "Users.znrind_minus_a0053.Documents.elasticsearch.logstash_minus_7_dot_4_dot_0.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$__VARARGS__(/Users/znrind-a0053/Documents/elasticsearch/logstash-7.4.0/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)", "Users.znrind_minus_a0053.Documents.elasticsearch.logstash_minus_7_dot_4_dot_0.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/Users/znrind-a0053/Documents/elasticsearch/logstash-7.4.0/logstash-core/lib/logstash/agent.rb:326)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77)", "org.jruby.runtime.Block.call(Block.java:129)", "org.jruby.RubyProc.call(RubyProc.java:295)", "org.jruby.RubyProc.call(RubyProc.java:274)", "org.jruby.RubyProc.call(RubyProc.java:270)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
>     warning: thread "Converge PipelineAction::Create<main>" terminated with exception (report_on_exception is true):
>     LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<main>`
>               create at org/logstash/execution/ConvergeResultExt.java:109
>                  add at org/logstash/execution/ConvergeResultExt.java:37

below is my logstash.config file

input {
          file {
                path => "/Users/znrind-a0053/Downloads/logs/app-info.log"
                start_position => "beginning"
                sincedb_path => "/dev/null"
          }
    }
    filter {
          grok {
          separate => " "
          pattern => "%{TIMESTAMP_ISO8601:timestamp} %{AUDITLOGLEVEL:level} %{PROG:program} %{GREEDYDATA:message}"
          }
    }
    output {
            elasticsearch {
                hosts => "localhost"
                index => "logs"
                document_type => "collected_logs"
            }
            stdout{}
    }

i have attached sample log files

[DEBUG] 2019-10-24 11:25:21.494 [main] ZCustomLogger - This is debug log
[ERROR] 2019-10-24 11:25:22.586 [main] ZCustomLogger - Runtime error..
java.lang.ArithmeticException: / by zero
	at com.zinier.common.util.ZCustomLogger.addLog(ZCustomLogger.java:26) [classes/:?]
	at com.zinier.common.util.ZCustomLogger.main(ZCustomLogger.java:14) [classes/:?]
[DEBUG] 2019-10-24 11:25:22.647 [main] ZCustomLogger - added a debug log
[DEBUG] 2019-10-24 14:17:02.676 [main] ZCustomLogger - This is debug log
[ERROR] 2019-10-24 14:17:03.205 [main] ZCustomLogger - Runtime error..
java.lang.ArithmeticException: / by zero
	at com.zinier.common.util.ZCustomLogger.addLog(ZCustomLogger.java:26) [classes/:?]
	at com.zinier.common.util.ZCustomLogger.main(ZCustomLogger.java:14) [classes/:?]
[DEBUG] 2019-10-24 14:17:03.232 [main] ZCustomLogger - added a debug log
[DEBUG] 2019-10-24 14:17:07.893 [main] ZCustomLogger - This is debug log
[ERROR] 2019-10-24 14:17:08.154 [main] ZCustomLogger - Runtime error..
java.lang.ArithmeticException: / by zero
	at com.zinier.common.util.ZCustomLogger.addLog(ZCustomLogger.java:26) [classes/:?]
	at com.zinier.common.util.ZCustomLogger.main(ZCustomLogger.java:14) [classes/:?]
[DEBUG] 2019-10-24 14:17:08.172 [main] ZCustomLogger - added a debug log
[DEBUG] 2019-10-24 14:17:35.070 [main] ZCustomLogger - This is debug log
[INFO ] 2019-10-24 14:17:35.329 [main] ZCustomLogger - Value of c = 1
[DEBUG] 2019-10-24 14:17:35.342 [main] ZCustomLogger - added a debug log

Any help is appreciated. Thanks in advance.

There should be a more specific error message immediately preceding this. grok does not have a "separate" option, so try removing that.

Thank you for the solution. I modified the config file as per your comments it worked

input {
file {
path => "/Users/znrind-a0053/Downloads/logs/app-info.log"
start_position => "beginning"
sincedb_path => "/Users/znrind-a0053/Documents/elasticsearch/el_logs/elfile"
}
}
filter {
grok {
match => {"messages" => "%{DATESTAMP_EVENTLOG:timestamp}%{SPACE}%{LOGLEVEL:log_level}%{SPACE}%{WORD:method}%{SPACE}%{WORD:class_name}%{SPACE}%{GREEDYDATA:log_message}"}
}
}
output {
elasticsearch {
hosts => "localhost"
index => "logs"
document_type => "collected_logs"
}
stdout{}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.