Logstash configuration works fine when output is tested with
output {
stdout { codec => rubydebug }
}
when sent to ES it errors out.
`input {
file {
path => "/opt/tomcat/logs/ds.log"
start_position => "beginning"
type => "ds"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
}
filter {
if [type] == "ds" {
mutate {
gsub => [ "message", "r", "" ]
}
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:logtimestamp},%{INT:millis} %{WORD:loglevel} [%{GREEDYDATA:thread}] %{GREEDYDATA:message}%{SPACE} - %{GREEDYDATA:exceptionmessage}",
"^%{TIMESTAMP_ISO8601:logtimestamp},%{INT:millis} %{WORD:loglevel} [%{GREEDYDATA:thread}] [%{DATA:status}] %{GREEDYDATA:message}%{SPACE} - %{GREEDYDATA:exceptionmessage}"
]
overwrite => ["message"]
}
}
date {
match => [ "logtimetimestamp" , "yyyy-MM-dd HH:mm:ss,SSS" ]
}
}
}
output {
amazon_es {
hosts => ["*******************************************************/"]
region => "us-west-2"
index => "test-messages-%{+YYYY.MM.dd}"
}
}
error "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client.build_adapter(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client.rb:284)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client.RUBY$method$build_adapter$0$__VARARGS__(usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java/lib/logstash/outputs/amazon_es//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client.rb)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client.build_pool(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client.rb:288)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client.RUBY$method$build_pool$0$__VARARGS__(usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java/lib/logstash/outputs/amazon_es//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client.rb)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client.initialize(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client.rb:54)", "org.jruby.RubyClass.newInstance(org/jruby/RubyClass.java:915)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(org/jruby/RubyClass$INVOKER$i$newInstance.gen)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client_builder.create_http_client(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client_builder.rb:110)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client_builder.RUBY$method$create_http_client$0$__VARARGS__(usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java/lib/logstash/outputs/amazon_es//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client_builder.rb)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client_builder.build(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client_builder.rb:98)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.http_client_builder.RUBY$method$build$0$__VARARGS__(usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java/lib/logstash/outputs/amazon_es//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es/http_client_builder.rb)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_amazon_es_minus_7_dot_0_dot_1_minus_java.lib.logstash.outputs.amazon_es.build_client(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-amazon_es-7.0.1-java/lib/logstash/outputs/amazon_es.rb:256)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:203)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$start_workers$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.run(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:145)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$run$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:104)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:295)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:274)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:270)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :thread=>"#<Thread:0x5a119184 run>"} [ERROR] 2020-04-04 14:37:21.917 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil} [INFO ] 2020-04-04 14:37:22.220 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600} [INFO ] 2020-04-04 14:37:27.199 [LogStash::Runner] runner - Logstash shut down.
Please find the log and confP`attached.
Appreciate your help.