Unusually rare error with regard to logstash

[PhobosDthorga]

Hello everyone!

We at GekkoFyre Networks are encountering an issue with logstash where we keep experiencing the same error over and over [ 1 ], causing the service to restart repeatedly until eventually, systemd terminates the misbehaving daemon.

[ 1 ] - https://paste.gekkofyre.io/view/a16eb1f2

Below you will find the configuration files relating to our Logstash setup within our metrics oriented server as well.

[ 2 ] - https://paste.gekkofyre.io/view/51e0207c

The virtual private server we've created for this particular workload also has plenty of resources itself, so we're pretty confident that this is not the cause at hand, with regard to the error experienced by logstash.

root@metrics:~# cat /proc/cpuinfo | grep processor | wc -l
6
root@metrics:~# free -h
              total        used        free      shared  buff/cache   available
Mem:            11G        4.4G        2.5G         39M        4.9G        7.1G
Swap:          2.0G          0B        2.0G
[root@norwaro ~]# inxi -C
CPU:       Topology: Quad Core model: Intel Xeon E3-1270 v6 bits: 64 type: MT MCP L2 cache: 8192 KiB
           Speed: 1108 MHz min/max: 800/4200 MHz Core speeds (MHz): 1: 1108 2: 908 3: 1150 4: 1056 5: 1398 6: 1137 7: 1361
           8: 2218
[root@norwaro ~]#

We've probably allocated too much RAM at this point in time actually, so I might have to reduce it by around 4 GB. But we'd appreciate any and all help on this matter, thank you. We are ultimately trying to setup sýnesis Lite for Suricata under Kibana and ElasticSearch.

[Badger]

Try running with --config.debug --log.level debug --config.test_and_exit on the command line. That will show you each file that it is loading as part of the configuration, and it will show you the merged configuration. You can then identify where line 14 is coming from.

Hang on, don't you need "output {" and "}" at the start and end of your /etc/logstash/conf.d/30-elasticsearch-output.conf?