Logstash cannot start due to error

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch-2.17.1
Logstash-8.15.2

Describe the issue:
I config Logstash as usual and use the command ./bin/logstash -f /etc/logstash/pipelines.yml to run Logstash, but it shows this error:

image
image1897×621 64.6 KB

Although I have installed and ran Logstash twice in the past and I use the same kind of configuration, but this time this error persists. Reading the logs I think the problem is in the pipelines.yml, but I cant figure out how to solve it

Configuration:
-------------------pipelines.yml--------------------

image
image1471×479 9.81 KB

-------------------/conf.d/1-input.conf:--------------------

image
image1462×221 4.65 KB

-------------------/conf.d/2-filter.conf:--------------------

image
image1875×854 33.1 KB

-------------------/conf.d/3-output.conf:--------------------

output {
  if [agent][type] == "auditbeat" {
    opensearch {
      hosts => ["https://localhost:9200"]
      index => "auditbeat-%{+YYYY.MM.dd}"
      user => "admin"
      password => "X"
      ssl => true
      ssl_certificate_verification => false
    }
  } else if [service][type] == "apache" {
    opensearch {
      hosts => ["https://localhost:9200"]
      index => "filebeat-%{+YYYY.MM.dd}"
      user => "admin"
      password => "X"
      ssl => true
      ssl_certificate_verification => false
    }
  } else if [agent][type] == "winlogbeat" {
    opensearch {
      hosts => ["https://localhost:9200"]
      index => "winlogbeat-%{+YYYY.MM.dd}"
      user => "admin"
      password => "X"
      ssl => true
      ssl_certificate_verification => false
    }
  } else if [agent][type] == "metricbeat" {
    opensearch {
      hosts => ["https://localhost:9200"]
      index => "metricbeat-%{+YYYY.MM.dd}"
      user => "admin"
      password => "X"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}
2

@gray653 Have you found a solution to your issue?

3

I’m still stuck at this, the solution might be reinstalling with different versions. I did it myself and it didn’t work out, but my colleague managed to fix the same problem by reinstalling.

4

@gray653 I’ve tested your configuration and I had no issues running it. The error is caused by an incorrect command line.
The -f option points to a single or multiple config files (.conf). In your example, you’ve pointed to the pipelines.yml file which caused Logstash to report missing input, filter and output config sections.

Try this instead

./bin/logstash -f '/etc/logstash/conf.d/{*conf}'

Alternatively, you can use piplines.yml by running the below command. Logstash will use pipelines.yml by default to load config files.

./bin/logstash