validating Logstash configuration

Question

I am trying to validate my logstash configuration.

Using :

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings -t -f /etc/logstash/conf.d

I received the following error:

penJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /tmp/hsperfdata_logstash/-t/log4j2.properties. Using default config which logs errors to the console [INFO ] 2018-10-09 14:56:50.240 [main] scaffold - Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"} [INFO ] 2018-10-09 14:56:50.265 [main] scaffold - Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"} [INFO ] 2018-10-09 14:56:50.378 [main] writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"} [INFO ] 2018-10-09 14:56:50.380 [main] writabledirectory - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"} [WARN ] 2018-10-09 14:56:51.099 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO ] 2018-10-09 14:56:51.126 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=>"80207611-d5b8-47dd-b229-23c2ade385ae", :path=>"/usr/share/logstash/data/uuid"} [INFO ] 2018-10-09 14:56:51.568 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.2.4"} [INFO ] 2018-10-09 14:56:52.021 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600} [ERROR] 2018-10-09 14:56:53.586 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] beats - Invalid setting for beats input plugin:

input { beats { # This setting must be a path # File does not exist or cannot be opened /etc/pki/tls/certs/logstash-forwarder.crt ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ... } } [ERROR] 2018-10-09 14:56:53.588 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] beats - Invalid setting for beats input plugin:

input { beats { # This setting must be a path # File does not exist or cannot be opened /etc/pki/tls/private/logstash-forwarder.key ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" ... } } [ERROR] 2018-10-09 14:56:53.644 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Something is wrong with your configuration.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:89:in config_init'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:62:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:89:in plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:112:in plugin'", "(eval):8:in <eval>'", "org/jruby/RubyKernel.java:994:in eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:84:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:inblock in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:inblock in converge_state'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in block in initialize'"]}

I would appreciate any help with this.

Answer 1

Please check logstash.yml file available on /etc/logstash ? If it available stop the logstash service and kill if any processes ruining on background. Save your config file on /etc/logstash/conf.d/your_file.conf. To run the config test go to, logstash bin directory and run

./logstash -f /etc/logstash/conf.d/your_config_file.conf --config.test_and_exit