API tools faq
paste
Guest User

Untitled

a guest
Oct 19th, 2017
696
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 37.52 KB | None | 0 0
raw download clone embed print report
  1. I've been trying to experiment with Elasticsearch and the Elastic Cloud because I might want to use it for the company I currently work for. I have a 2 week trial, but I'm afraid I've not yet come very far because I cannot manage to get Logstash running without issues. This is my logstash.yml (mostly just default settings):
  2.  
  3. [details="Summary"]
  4. # Settings file in YAML
  5. #
  6. # Settings can be specified either in hierarchical form, e.g.:
  7. #
  8. # pipeline:
  9. # batch:
  10. # size: 125
  11. # delay: 5
  12. #
  13. # Or as flat keys:
  14. #
  15. # pipeline.batch.size: 125
  16. # pipeline.batch.delay: 5
  17. #
  18. # ------------ Node identity ------------
  19. #
  20. # Use a descriptive name for the node:
  21. #
  22. # node.name: test
  23. #
  24. # If omitted the node name will default to the machine's host name
  25. #
  26. # ------------ Data path ------------------
  27. #
  28. # Which directory should be used by logstash and its plugins
  29. # for any persistent needs. Defaults to LOGSTASH_HOME/data
  30. #
  31. #path.data: /var/lib/logstash
  32. #
  33. # ------------ Pipeline Settings --------------
  34. #
  35. # Set the number of workers that will, in parallel, execute the filters+outputs
  36. # stage of the pipeline.
  37. #
  38. # This defaults to the number of the host's CPU cores.
  39. #
  40. # pipeline.workers: 2
  41. #
  42. # How many workers should be used per output plugin instance
  43. #
  44. # pipeline.output.workers: 1
  45. #
  46. # How many events to retrieve from inputs before sending to filters+workers
  47. #
  48. # pipeline.batch.size: 125
  49. #
  50. # How long to wait before dispatching an undersized batch to filters+workers
  51. # Value is in milliseconds.
  52. #
  53. # pipeline.batch.delay: 5
  54. #
  55. # Force Logstash to exit during shutdown even if there are still inflight
  56. # events in memory. By default, logstash will refuse to quit until all
  57. # received events have been pushed to the outputs.
  58. #
  59. # WARNING: enabling this can lead to data loss during shutdown
  60. #
  61. # pipeline.unsafe_shutdown: false
  62. #
  63. # ------------ Pipeline Configuration Settings --------------
  64. #
  65. # Where to fetch the pipeline configuration for the main pipeline
  66. #
  67. path.config: /etc/logstash/conf.d
  68. #
  69. # Pipeline configuration string for the main pipeline
  70. #
  71. # config.string:
  72. #
  73. # At startup, test if the configuration is valid and exit (dry run)
  74. #
  75. # config.test_and_exit: false
  76. #
  77. # Periodically check if the configuration has changed and reload the pipeline
  78. # This can also be triggered manually through the SIGHUP signal
  79. #
  80. #config.reload.automatic: true
  81.  
  82. #
  83. # How often to check if the pipeline configuration has changed (in seconds)
  84. #
  85. config.reload.interval: 3
  86. #
  87. # Show fully compiled configuration as debug log message
  88. # NOTE: --log.level must be 'debug'
  89. #
  90. config.debug: true
  91. #
  92. # When enabled, process escaped characters such as \n and \" in strings in the
  93. # pipeline configuration files.
  94. #
  95. # config.support_escapes: false
  96. #
  97. # ------------ Module Settings ---------------
  98. # Define modules here. Modules definitions must be defined as an array.
  99. # The simple way to see this is to prepend each `name` with a `-`, and keep
  100. # all associated variables under the `name` they are associated with, and
  101. # above the next, like this:
  102. #
  103. # modules:
  104. # - name: MODULE_NAME
  105. # var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
  106. # var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
  107. # var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
  108. # var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
  109. #
  110. # Module variable names must be in the format of
  111. #
  112. # var.PLUGIN_TYPE.PLUGIN_NAME.KEY
  113. #
  114. # modules:
  115. #
  116. # ------------ Queuing Settings --------------
  117. #
  118. # Internal queuing model, "memory" for legacy in-memory based queuing and
  119. # "persisted" for disk-based acked queueing. Defaults is memory
  120. #
  121. # queue.type: memory
  122. #
  123. # If using queue.type: persisted, the directory path where the data files will be stored.
  124. # Default is path.data/queue
  125. #
  126. # path.queue:
  127. #
  128. # If using queue.type: persisted, the page data files size. The queue data consists of
  129. # append-only data files separated into pages. Default is 250mb
  130. #
  131. # queue.page_capacity: 250mb
  132. #
  133. # If using queue.type: persisted, the maximum number of unread events in the queue.
  134. # Default is 0 (unlimited)
  135. #
  136. # queue.max_events: 0
  137. #
  138. # If using queue.type: persisted, the total capacity of the queue in number of bytes.
  139. # If you would like more unacked events to be buffered in Logstash, you can increase the
  140. # capacity using this setting. Please make sure your disk drive has capacity greater than
  141. # the size specified here. If both max_bytes and max_events are specified, Logstash will pick
  142. # whichever criteria is reached first
  143. # Default is 1024mb or 1gb
  144. #
  145. # queue.max_bytes: 1024mb
  146. #
  147. # If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
  148. # Default is 1024, 0 for unlimited
  149. #
  150. # queue.checkpoint.acks: 1024
  151. #
  152. # If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
  153. # Default is 1024, 0 for unlimited
  154. #
  155. # queue.checkpoint.writes: 1024
  156. #
  157. # If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
  158. # Default is 1000, 0 for no periodic checkpoint.
  159. #
  160. # queue.checkpoint.interval: 1000
  161. #
  162. # ------------ Dead-Letter Queue Settings --------------
  163. # Flag to turn on dead-letter queue.
  164. #
  165. # dead_letter_queue.enable: false
  166.  
  167. # If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
  168. # will be dropped if they would increase the size of the dead letter queue beyond this setting.
  169. # Default is 1024mb
  170. # dead_letter_queue.max_bytes: 1024mb
  171.  
  172. # If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
  173. # Default is path.data/dead_letter_queue
  174. #
  175. # path.dead_letter_queue:
  176. #
  177. # ------------ Metrics Settings --------------
  178. #
  179. # Bind address for the metrics REST endpoint
  180. #
  181. # http.host: "127.0.0.1"
  182. #
  183. # Bind port for the metrics REST endpoint, this option also accept a range
  184. # (9600-9700) and logstash will pick up the first available ports.
  185. #
  186. # http.port: 9600-9700
  187. #
  188. # ------------ Debugging Settings --------------
  189. #
  190. # Options for log.level:
  191. # * fatal
  192. # * error
  193. # * warn
  194. # * info (default)
  195. # * debug
  196. # * trace
  197. #
  198. log.level: debug
  199. path.logs: /var/log/logstash
  200. #
  201. # ------------ Other Settings --------------
  202. #
  203. # Where to find custom plugins
  204. # path.plugins: []
  205. [/details]
  206.  
  207. I want to use Filebeat to send apache logs realtime to the Elastic Cloud so I can analyze them. My logstash.conf looks like this:
  208.  
  209.  
  210. [details="Summary"]
  211. input {
  212. beats {
  213. host => "127.0.0.1"
  214. port => 5044
  215. }
  216. }
  217.  
  218. # The filter part of this file is commented out to indicate that it is
  219. # optional.
  220. # filter {
  221. #
  222. # }
  223.  
  224. output {
  225. elasticsearch {
  226. hosts => ["https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243"]
  227. user => "Jens"
  228. password => "pass"
  229. manage_template => false
  230. index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  231. document_type => "%{[@metadata][type]}"
  232. }
  233. }
  234. [/details]
  235.  
  236.  
  237. The pipeline is never actually created. Below is the error which I think is causing all this trouble, but I have honestly no idea how to fix it (or what the cause is).
  238.  
  239. [details="Summary"]
  240. [2017-10-19T15:05:35,247][ERROR][logstash.pipeline ] Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0x2d46745c @namespaced_metric=#<LogStash::Instrument::NamespacedMetric:0x3fb113ac @metric=#<LogStash::Instrument::Metric:0x39c77192 @collector=#<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x4430a86b @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x732bef32>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\"]>, @metric=#<LogStash::Instrument::NamespacedMetric:0x7dbb1361 @metric=#<LogStash::Instrument::Metric:0x39c77192 @collector=#<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x4430a86b @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x732bef32>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs]>, @logger=#<LogStash::Logging::Logger:0x1077b591 @logger=#<Java::OrgApacheLoggingLog4jCore::Logger:0x24b8860e>>, @out_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: out value: 0, @in_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: in value: 0, @strategy=#<LogStash::OutputDelegatorStrategies::Shared:0x26295cb0 @output=<LogStash::Outputs::ElasticSearch hosts=>[https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243], user=>\"Jens\", password=><password>, manage_template=>false, index=>\"%{[@metadata][beat]}-%{+YYYY.MM.dd}\", document_type=>\"%{[@metadata][type]}\", id=>\"8f2791f16b92257ba930f259763a80cdb7570108-2\", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_ac1228ed-ffe4-4565-aa96-c38800fd7d43\", enable_metric=>true, charset=>\"UTF-8\">, workers=>1, template_name=>\"logstash\", template_overwrite=>false, idle_flush_time=>1, doc_as_upsert=>false, script_type=>\"inline\", script_lang=>\"painless\", script_var_name=>\"event\", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, action=>\"index\", ssl_certificate_verification=>true, sniffing=>false, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false, ssl=>true>>, @id=\"8f2791f16b92257ba930f259763a80cdb7570108-2\", @time_metric=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: duration_in_millis value: 0, @metric_events=#<LogStash::Instrument::NamespacedMetric:0xb5fbed9 @metric=#<LogStash::Instrument::Metric:0x39c77192 @collector=#<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x4430a86b @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x732bef32>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events]>, @output_class=LogStash::Outputs::ElasticSearch>", :error=>"Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (byte[])\"<script>var hashRoute = '/app/kibana';\nvar defaultRoute = '/app/kibana';\n\nvar hash = window.location.hash;\nif (hash.length) {\n window.location = hashRoute + hash;\n} else {\n window.location = defaultRoute;\n}</script>\"; line: 1, column: 2]"}
  241. [2017-10-19T15:05:35,254][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
  242. [/details]
  243.  
  244. This line comes from my logstash-plain.log - the following is what happens over and over again because Logstash is trying to start again after it has stopped.
  245.  
  246. The entire log:
  247. [details="Summary"]
  248. [2017-10-19T15:41:06,549][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
  249. [2017-10-19T15:41:06,551][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"netflow", :type=>:modules, :class=>#<LogStash::Modules::Scaffold:0x75afc9e2 @kibana_version_parts=["5", "6", "0"], @module_name="netflow", @directory="/usr/share/logstash/modules/netflow/configuration">}
  250. [2017-10-19T15:41:06,552][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
  251. [2017-10-19T15:41:06,552][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"fb_apache", :type=>:modules, :class=>#<LogStash::Modules::Scaffold:0x2d6e1cbf @kibana_version_parts=["5", "6", "0"], @module_name="fb_apache", @directory="/usr/share/logstash/modules/fb_apache/configuration">}
  252. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] -------- Logstash Settings (* means modified) ---------
  253. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] node.name: "136-144-139-19.colo.transip.net"
  254. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] *path.config: "/etc/logstash/conf.d"
  255. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] path.data: "/usr/share/logstash/data"
  256. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] modules.cli: []
  257. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] modules: []
  258. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] modules_setup: false
  259. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] config.test_and_exit: false
  260. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] config.reload.automatic: false
  261. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] config.support_escapes: false
  262. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] config.reload.interval: 3
  263. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] metric.collect: true
  264. [2017-10-19T15:41:06,566][DEBUG][logstash.runner ] pipeline.id: "main"
  265. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.system: false
  266. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.workers: 3
  267. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.output.workers: 1
  268. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.batch.size: 125
  269. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.batch.delay: 5
  270. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] pipeline.unsafe_shutdown: false
  271. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] path.plugins: []
  272. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] *config.debug: true (default: false)
  273. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] *log.level: "debug" (default: "info")
  274. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] version: false
  275. [2017-10-19T15:41:06,567][DEBUG][logstash.runner ] help: false
  276. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] log.format: "plain"
  277. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] http.host: "127.0.0.1"
  278. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] http.port: 9600..9700
  279. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] http.environment: "production"
  280. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.type: "memory"
  281. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.drain: false
  282. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.page_capacity: 262144000
  283. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.max_bytes: 1073741824
  284. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.max_events: 0
  285. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.checkpoint.acks: 1024
  286. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.checkpoint.writes: 1024
  287. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] queue.checkpoint.interval: 1000
  288. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] dead_letter_queue.enable: false
  289. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] dead_letter_queue.max_bytes: 1073741824
  290. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] slowlog.threshold.warn: -1
  291. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] slowlog.threshold.info: -1
  292. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] slowlog.threshold.debug: -1
  293. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] slowlog.threshold.trace: -1
  294. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] path.queue: "/usr/share/logstash/data/queue"
  295. [2017-10-19T15:41:06,568][DEBUG][logstash.runner ] path.dead_letter_queue: "/usr/share/logstash/data/dead_letter_queue"
  296. [2017-10-19T15:41:06,569][DEBUG][logstash.runner ] *path.settings: "/etc/logstash" (default: "/usr/share/logstash/config")
  297. [2017-10-19T15:41:06,569][DEBUG][logstash.runner ] *path.logs: "/var/log/logstash" (default: "/usr/share/logstash/logs")
  298. [2017-10-19T15:41:06,569][DEBUG][logstash.runner ] --------------- Logstash Settings -------------------
  299. [2017-10-19T15:41:06,590][DEBUG][logstash.agent ] Agent: Configuring metric collection
  300. [2017-10-19T15:41:06,592][DEBUG][logstash.instrument.periodicpoller.os] PeriodicPoller: Starting {:polling_interval=>5, :polling_timeout=>120}
  301. [2017-10-19T15:41:06,610][DEBUG][logstash.instrument.periodicpoller.jvm] PeriodicPoller: Starting {:polling_interval=>5, :polling_timeout=>120}
  302. [2017-10-19T15:41:06,635][DEBUG][logstash.instrument.periodicpoller.persistentqueue] PeriodicPoller: Starting {:polling_interval=>5, :polling_timeout=>120}
  303. [2017-10-19T15:41:06,636][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] PeriodicPoller: Starting {:polling_interval=>5, :polling_timeout=>120}
  304. [2017-10-19T15:41:06,638][DEBUG][logstash.agent ] Reading config file {:config_file=>"/etc/logstash/conf.d/logstash.conf"}
  305. [2017-10-19T15:41:06,639][DEBUG][logstash.agent ]
  306. The following is the content of a file {:config_file=>"/etc/logstash/conf.d/logstash.conf"}
  307. [2017-10-19T15:41:06,639][DEBUG][logstash.agent ]
  308. input {
  309. beats {
  310. host => "127.0.0.1"
  311. port => 5044
  312. }
  313. }
  314.  
  315. # The filter part of this file is commented out to indicate that it is
  316. # optional.
  317. # filter {
  318. #
  319. # }
  320.  
  321. output {
  322. elasticsearch {
  323. hosts => ["https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243"]
  324. user => "Jens"
  325. password => "pass"
  326. manage_template => false
  327. index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  328. document_type => "%{[@metadata][type]}"
  329. }
  330. }
  331.  
  332.  
  333.  
  334. [2017-10-19T15:41:06,639][DEBUG][logstash.agent ]
  335. The following is the merged configuration
  336. [2017-10-19T15:41:06,639][DEBUG][logstash.agent ]
  337. input {
  338. beats {
  339. host => "127.0.0.1"
  340. port => 5044
  341. }
  342. }
  343.  
  344. # The filter part of this file is commented out to indicate that it is
  345. # optional.
  346. # filter {
  347. #
  348. # }
  349.  
  350. output {
  351. elasticsearch {
  352. hosts => ["https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243"]
  353. user => "Jens"
  354. password => "pass"
  355. manage_template => false
  356. index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  357. document_type => "%{[@metadata][type]}"
  358. }
  359. }
  360.  
  361.  
  362.  
  363.  
  364. [2017-10-19T15:41:06,655][DEBUG][logstash.pipeline ] Compiled pipeline code {:code=>" @inputs = []\n @filters = []\n @outputs = []\n @periodic_flushers = []\n @shutdown_flushers = []\n @generated_objects = {}\n\n @generated_objects[:input_beats_1] = plugin(\"input\", \"beats\", LogStash::Util.hash_merge_many({ \"host\" => (\"127.0.0.1\") }, { \"port\" => 5044 }))\n\n @inputs << @generated_objects[:input_beats_1]\n\n @generated_objects[:output_elasticsearch_2] = plugin(\"output\", \"elasticsearch\", LogStash::Util.hash_merge_many({ \"hosts\" => [(\"https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243\")] }, { \"user\" => (\"Jens\") }, { \"password\" => (\"Metang96\") }, { \"manage_template\" => (\"false\") }, { \"index\" => (\"%{[@metadata][beat]}-%{+YYYY.MM.dd}\") }, { \"document_type\" => (\"%{[@metadata][type]}\") }))\n\n @outputs << @generated_objects[:output_elasticsearch_2]\n\n define_singleton_method :filter_func do |event|\n events = event\n @logger.debug? && @logger.debug(\"filter received\", \"event\" => event.to_hash)\n events\n end\n define_singleton_method :output_func do |event|\n targeted_outputs = []\n @logger.debug? && @logger.debug(\"output received\", \"event\" => event.to_hash)\n targeted_outputs << @generated_objects[:output_elasticsearch_2]\n \n targeted_outputs\n end"}
  365. [2017-10-19T15:41:06,689][DEBUG][logstash.plugins.registry] On demand adding plugin to the registry {:name=>"beats", :type=>"input", :class=>LogStash::Inputs::Beats}
  366. [2017-10-19T15:41:06,694][DEBUG][logstash.plugins.registry] On demand adding plugin to the registry {:name=>"plain", :type=>"codec", :class=>LogStash::Codecs::Plain}
  367. [2017-10-19T15:41:06,697][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@id = "plain_4476099f-7f6f-4bba-95c4-223f151b34b2"
  368. [2017-10-19T15:41:06,697][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@enable_metric = true
  369. [2017-10-19T15:41:06,697][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@charset = "UTF-8"
  370. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@host = "127.0.0.1"
  371. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@port = 5044
  372. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@id = "8f2791f16b92257ba930f259763a80cdb7570108-1"
  373. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@enable_metric = true
  374. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@codec = <LogStash::Codecs::Plain id=>"plain_4476099f-7f6f-4bba-95c4-223f151b34b2", enable_metric=>true, charset=>"UTF-8">
  375. [2017-10-19T15:41:06,698][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@add_field = {}
  376. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@ssl = false
  377. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@ssl_certificate_authorities = []
  378. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@ssl_verify_mode = "none"
  379. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@include_codec_tag = true
  380. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@ssl_handshake_timeout = 10000
  381. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@tls_min_version = 1
  382. [2017-10-19T15:41:06,699][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@tls_max_version = 1.2
  383. [2017-10-19T15:41:06,700][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@cipher_suites = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"]
  384. [2017-10-19T15:41:06,700][DEBUG][logstash.inputs.beats ] config LogStash::Inputs::Beats/@client_inactivity_timeout = 60
  385. [2017-10-19T15:41:06,741][DEBUG][logstash.plugins.registry] On demand adding plugin to the registry {:name=>"elasticsearch", :type=>"output", :class=>LogStash::Outputs::ElasticSearch}
  386. [2017-10-19T15:41:06,745][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@id = "plain_ecb1f3b3-2a2c-47b9-9f20-abaf20447d5e"
  387. [2017-10-19T15:41:06,745][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@enable_metric = true
  388. [2017-10-19T15:41:06,745][DEBUG][logstash.codecs.plain ] config LogStash::Codecs::Plain/@charset = "UTF-8"
  389. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@hosts = [https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243]
  390. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@user = "Jens"
  391. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@password = <password>
  392. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@manage_template = false
  393. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@index = "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  394. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@document_type = "%{[@metadata][type]}"
  395. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@id = "8f2791f16b92257ba930f259763a80cdb7570108-2"
  396. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@enable_metric = true
  397. [2017-10-19T15:41:06,747][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@codec = <LogStash::Codecs::Plain id=>"plain_ecb1f3b3-2a2c-47b9-9f20-abaf20447d5e", enable_metric=>true, charset=>"UTF-8">
  398. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@workers = 1
  399. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@template_name = "logstash"
  400. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@template_overwrite = false
  401. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@parent = nil
  402. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@idle_flush_time = 1
  403. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@upsert = ""
  404. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@doc_as_upsert = false
  405. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@script = ""
  406. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@script_type = "inline"
  407. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@script_lang = "painless"
  408. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@script_var_name = "event"
  409. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@scripted_upsert = false
  410. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@retry_initial_interval = 2
  411. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@retry_max_interval = 64
  412. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@retry_on_conflict = 1
  413. [2017-10-19T15:41:06,748][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@pipeline = nil
  414. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@action = "index"
  415. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@ssl_certificate_verification = true
  416. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@sniffing = false
  417. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@sniffing_delay = 5
  418. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@timeout = 60
  419. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@failure_type_logging_whitelist = []
  420. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@pool_max = 1000
  421. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@pool_max_per_route = 100
  422. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@resurrect_delay = 5
  423. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@validate_after_inactivity = 10000
  424. [2017-10-19T15:41:06,749][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::ElasticSearch/@http_compression = false
  425. [2017-10-19T15:41:06,760][DEBUG][logstash.agent ] starting agent
  426. [2017-10-19T15:41:06,763][DEBUG][logstash.agent ] starting pipeline {:id=>"main"}
  427. [2017-10-19T15:41:06,765][DEBUG][logstash.outputs.elasticsearch] Normalizing http path {:path=>nil, :normalized=>nil}
  428. [2017-10-19T15:41:06,974][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://Jens:[email protected]:9243/]}}
  429. [2017-10-19T15:41:06,974][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://Jens:[email protected]:9243/, :path=>"/"}
  430. [2017-10-19T15:41:07,443][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://Jens:[email protected]:9243/"}
  431. [2017-10-19T15:41:07,552][ERROR][logstash.pipeline ] Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0x39d9457f @namespaced_metric=#<LogStash::Instrument::NamespacedMetric:0x7d29941f @metric=#<LogStash::Instrument::Metric:0x3df568 @collector=#<LogStash::Instrument::Collector:0x1913b642 @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x6a92eaa2 @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x5baa1283>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\"]>, @metric=#<LogStash::Instrument::NamespacedMetric:0x30762b55 @metric=#<LogStash::Instrument::Metric:0x3df568 @collector=#<LogStash::Instrument::Collector:0x1913b642 @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x6a92eaa2 @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x5baa1283>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs]>, @logger=#<LogStash::Logging::Logger:0x46f92d33 @logger=#<Java::OrgApacheLoggingLog4jCore::Logger:0x62cc94c5>>, @out_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: out value: 0, @in_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: in value: 0, @strategy=#<LogStash::OutputDelegatorStrategies::Shared:0x479a2e4d @output=<LogStash::Outputs::ElasticSearch hosts=>[https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243], user=>\"Jens\", password=><password>, manage_template=>false, index=>\"%{[@metadata][beat]}-%{+YYYY.MM.dd}\", document_type=>\"%{[@metadata][type]}\", id=>\"8f2791f16b92257ba930f259763a80cdb7570108-2\", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_ecb1f3b3-2a2c-47b9-9f20-abaf20447d5e\", enable_metric=>true, charset=>\"UTF-8\">, workers=>1, template_name=>\"logstash\", template_overwrite=>false, idle_flush_time=>1, doc_as_upsert=>false, script_type=>\"inline\", script_lang=>\"painless\", script_var_name=>\"event\", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, action=>\"index\", ssl_certificate_verification=>true, sniffing=>false, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false, ssl=>true>>, @id=\"8f2791f16b92257ba930f259763a80cdb7570108-2\", @time_metric=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events] key: duration_in_millis value: 0, @metric_events=#<LogStash::Instrument::NamespacedMetric:0x48050338 @metric=#<LogStash::Instrument::Metric:0x3df568 @collector=#<LogStash::Instrument::Collector:0x1913b642 @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x6a92eaa2 @store=#<Concurrent::Map:0x000000000644a8 entries=3 default_proc=nil>, @structured_lookup_mutex=#<Mutex:0x5baa1283>, @fast_lookup=#<Concurrent::Map:0x000000000644ac entries=61 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :main, :plugins, :outputs, :\"8f2791f16b92257ba930f259763a80cdb7570108-2\", :events]>, @output_class=LogStash::Outputs::ElasticSearch>", :error=>"Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (byte[])\"<script>var hashRoute = '/app/kibana';\nvar defaultRoute = '/app/kibana';\n\nvar hash = window.location.hash;\nif (hash.length) {\n window.location = hashRoute + hash;\n} else {\n window.location = defaultRoute;\n}</script>\"; line: 1, column: 2]"}
  432. [2017-10-19T15:41:07,559][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
  433. at [Source: (byte[])"<script>var hashRoute = '/app/kibana';
  434. var defaultRoute = '/app/kibana';
  435.  
  436. var hash = window.location.hash;
  437. if (hash.length) {
  438. window.location = hashRoute + hash;
  439. } else {
  440. window.location = defaultRoute;
  441. }</script>"; line: 1, column: 2]>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/json.rb:41:in `jruby_load'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:435:in `get_es_version'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:245:in `healthcheck!'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:237:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:329:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:70:in `start'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:290:in `build_pool'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:60:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:101:in `create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:97:in `build'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch.rb:230:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/common.rb:24:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:43:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301:in `register_plugins'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:310:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:398:in `start_pipeline'"]}
  442. [2017-10-19T15:41:07,570][DEBUG][logstash.agent ] Starting puma
  443. [2017-10-19T15:41:07,571][DEBUG][logstash.agent ] Trying to start WebServer {:port=>9600}
  444. [2017-10-19T15:41:07,573][DEBUG][logstash.api.service ] [api-service] start
  445. [2017-10-19T15:41:07,591][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
  446. [2017-10-19T15:41:10,571][DEBUG][logstash.instrument.periodicpoller.os] PeriodicPoller: Stopping
  447. [2017-10-19T15:41:10,571][DEBUG][logstash.instrument.periodicpoller.jvm] PeriodicPoller: Stopping
  448. [2017-10-19T15:41:10,571][DEBUG][logstash.instrument.periodicpoller.persistentqueue] PeriodicPoller: Stopping
  449. [2017-10-19T15:41:10,572][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] PeriodicPoller: Stopping
  450. [2017-10-19T15:41:10,576][WARN ][logstash.agent ] stopping pipeline {:id=>"main"}
  451. [2017-10-19T15:41:10,577][DEBUG][logstash.pipeline ] Closing inputs
  452. [2017-10-19T15:41:10,578][DEBUG][logstash.inputs.beats ] stopping {:plugin=>"LogStash::Inputs::Beats"}
  453. [2017-10-19T15:41:10,578][DEBUG][logstash.pipeline ] Closed inputs
  454.  
  455. [/details]
  456.  
  457. I'm entirely out of ideas. I've looked at the documentation, Googled the error messages... I have no clue why it's not working.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!