elasticsearchlogstashlogstash-configurationelklogstash-file

Can't not start logstash when enable security At elastic search and Kibana


I'm try to using Security function at ELK. My elastic version is 7.5.1

I'm having a problem with the file config. i can't start logstash

1.First, i enable security in elasticsearch.yml by added xpack.security.enabled: true

2.Second, at kibana.yml i edit elasticsearch.username = "elasctic" and elasticsearch.password is my set up password

I start service elasticsearch and kibana. still here everythings is ok.

3.Then i run my logstash with the conf below:

    input {
        file {
                path => ["/etc/logstash/handleexception1.txt"]
        type => "_doc"
                start_position => beginning
        }
}
filter {
        dissect {
            mapping => {
                "message" => "%{Date} %{Time} %{INFO} %{Service} Message:%{Message} ExceptionList:%{ExceptionList}"
            }
        }
}
output {
                hosts => ["localhost:9200"]
        index => "logstashhhandlerror2"
        user => "elastic"
        pasword => "elastic"
        }
        stdout { codec => rubydebug}
}

acctually i was try both

input {
elasticsearch{
    file {
            path => ["/etc/logstash/handleexception1.txt"]
    type => "_doc"
            start_position => beginning
    }
user => "elastic"
password => "elastic"
}
}

filter {
    elasticsearch{
        dissect {
            mapping => {
                "message" => "%{Date} %{Time} %{INFO} %{Service} Message:%{Message} ExceptionList:%{ExceptionList}"
            }
        }
    user => "elastic"
    password => "elastic"
    }
}
output {
                hosts => ["localhost:9200"]
        index => "logstashhhandlerror2"
        user => "elastic"
        pasword => "elastic"
        }
        stdout { codec => rubydebug}
}

Here is the screen when i try to start logtash.service

enter image description here

Thanks for reading and hoping you have ask for my problem.


Solution

  • your point 3 config should be working only you need to make one change for index creation, update output:

    output {
        elasticsearch {
          hosts => ["localhost:9200"]
          index => "logstashhhandlerror2"
          user => "elastic"
          pasword => "elastic"
        }
        stdout { codec => rubydebug}
      }
     }