Logstash server configuration issues

Question

I am currently building a centralized logging setup using logstash and kibana. I have successfully installed the server but currently stuck with the following issue.

All my configurations seem to be fine,

root@centralizedlogging-421413:/opt/logstash/bin# ./logstash --configtest -f    /etc/logstash/conf.d/01-lumberjack-input.conf
Using milestone 1 input plugin 'lumberjack'. This plugin should work, but would benefit from use by folks like you. Please let us know if you find bugs or have suggestions on how to improve this plugin. For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones {:level=>:warn}
Configuration OK
root@centralizedlogging-421413:/opt/logstash/bin# ./logstash --configtest -f /etc/logstash/conf.d/10-syslog.conf
Using milestone 1 filter plugin 'syslog_pri'. This plugin should work, but would benefit from use by folks like you. Please let us know if you find bugs or have suggestions on how to improve this plugin. For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones {:level=>:warn}
Configuration OK
root@centralizedlogging-421413:/opt/logstash/bin# ./logstash --configtest -f /etc/logstash/conf.d/30-lumberjack-output.conf
Configuration OK

But still my logstash.log gives me the following error,

{:timestamp=>"2014-12-08T09:25:43.250000+0000", :message=>"Error: Expected one of #, input, filter, output at line 29, column 1 (byte 734) after "} {:timestamp=>"2014-12-08T09:25:43.260000+0000", :message=>"You may be interested in the '--configtest' flag which you can\nuse to validate logstash's configuration before you choose\nto restart a running system."}

Am not sure from where this error is triggered.

Here are the input files,

01-lumberjack-input.conf
input {
  lumberjack {
    port => 5000
    type => "logs"
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

10-syslog.conf
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

30-lumberjack-output.conf
output {
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

Any help will be appreciated.

I followed this tutorial, digitalocean.com/community/tutorials/… and created the respective input, filter and output config files. — Karthik
There is no line 29 in any of these configs. That is why it is difficult to debug. — Karthik
I still suspect you have an additional config file in /etc/logstash/conf.d. You can try starting Logstash with --debug to get additional information about which configuration files Logstash tries to read. — Magnus Bäck

Karthik Karthik · Accepted Answer · 2014-12-09T09:34:33

I solved the issue. It was a permission issue because of which the ssl keys weren't read properly. So, I moved the files (certificate and key) to /etc/ssl folder and also issued a 666 access to the files.

After this, I restarted the service and now there are no errors.

Thanks everyone for the response. I could debug the issue only with these replies.

Thanks, Karthik

Logstash server configuration issues

1 Answers