ELK-logstash.conf is always wrong

Question

I want use Filebeat with logstash.But the logstash.conf is wrong.

logstash.conf:

```

input {
    beats {
        port => "5044"
    }
}

output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

```

It reponse this:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 3, column 1 (byte 76) after ", :backtrace=>["/opt/logstash/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:171:in initialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:335:in block in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:332:in block in converge_state'", "org/jruby/RubyArray.java:1734:ineach'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:319:in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:166:inblock in converge_state_and_update'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:164:inconverge_state_and_update'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:90:in execute'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:343:inblock in execute'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

MrSimple MrSimple · Accepted Answer · 2018-02-07T09:06:02

The beats plugin is wrong. The port should be a number.

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

Also you have no filter plugin, maybe that will be necessary too:

input {
    beats {
        port => 5044
    }
}
filter{}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

ELK-logstash.conf is always wrong

1 Answers