4

I am getting config error while launching Logstash. I am using 7.5.1 version. Same config file worked earlier. I had to setup ELK stash on another VM since older VM was decommissioned, and I am facing this error here.

I'm instantiating logstash using -

logstash-7.5.1\bin\logstash -f logstash-config.conf

.

Config File -

#config file

input{
jdbc{
jdbc_driver_library=>"C:\software\ojdbc7.jar"
jdbc_driver_class=>"Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string=>"jdbc:oracle:thin:@<host>:1528:TSTIM"
jdbc_user=>"UName"
jdbc_password=>"PWD"
statement=>"SELECT * from TABLE where run_id > 4500"
}
}

output{
elasticsearch{
hosts=>"http://localhost:9200"
index=>"run_id"
document_type=>"TABLEname"
document_id=>"run_id"
user=>"elastic"
password=>"changeme"
}
stdout{
codec=>rubydebug
}
}

.

Error - 

C:\software>logstash-7.5.1\bin\logstash -f logstash-config.conf
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to C:/software/logstash-7.5.1/logs which is now configured via log4j2.properties
[2020-01-08T05:04:33,207][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-01-08T05:04:33,426][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.5.1"}
[2020-01-08T05:04:34,869][ERROR][logstash.agent ] Failed to execute action 
{:action=>LogStash::PipelineAction::Create/pipeline_id:main,
:exception=>"LogStash::ConfigurationError",
:message=>"Expected one of [ \t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)", 
:backtrace=>[
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'",
"org/jruby/RubyArray.java:2584:in map'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", 
"org/logstash/execution/AbstractPipelineExt.java:156:in initialize'",
"org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/java_pipeline.rb:27:in initialize'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"
]}
[2020-01-08T05:04:35,510][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-01-08T05:04:40,325][INFO ][logstash.runner ] Logstash shut down.

enter image description here

Shreyas SG
  • 368
  • 3
  • 6
  • 21

3 Answers3

2

My bad. The config file had some bad characters. I just had to cleanup. Hand typing the same config content onto another file worked.

Shreyas SG
  • 368
  • 3
  • 6
  • 21
0

I have faced the same issue on Windows using Notepad++.

My solution is to save config into UTF-8 without BOM and Unix format (LF).

Sergey Nemchinov
  • 1,348
  • 15
  • 21
0

I have the same issue, when copy/paste some strings in my config file from web page. The reason is that there are non-printable characters other than "tab" or "whitespace" at the beginning of the line. You can see the difference between good and bad lines if you select the entire contents of the file in VS Code.

I replaced bad characters to spaces and the problem was solved.

Roman Z
  • 139
  • 2
  • 5