CODEWITHSUNDEEP
elasticsearchlogstashfilebeat
Vamshi Siddarth
Vamshi Siddarth

Reputation: 680

Logstash Error | lumberjack protocol error

We are trying to push our logs from JournalBeat to Logstash. We see some data populated in logstash after the journalbeat service is started. But, not sure why our jounrnalbeat logs are continuously giving the below error message.

2020-07-07T11:52:33.506Z        INFO    [publisher_pipeline_output]     pipeline/output.go:152  Connection to backoff(async(tcp://logstash-hostname:5044)) established
2020-07-07T11:52:33.562Z        ERROR   [logstash]      logstash/async.go:280   Failed to publish events caused by: lumberjack protocol error
2020-07-07T11:52:33.562Z        INFO    [publisher]     pipeline/retry.go:221   retryer: send unwait signal to consumer
2020-07-07T11:52:33.562Z        INFO    [publisher]     pipeline/retry.go:225     done

journalbeat.yml config is as below for the output.

    output.logstash:
      hosts: ["logstash-hostname:5044"]
      protocol: "http"
      index: "journal-${ENVIRONMENT}-system-%{[agent.version]}-%{+YYYY.MM.dd}"
      indices:
        - index: "journal-${ENVIRONMENT}-k8s-%{[agent.version]}-%{+YYYY.MM.dd}"
          when.has_fields:
          - 'kubernetes.namespace'

Below is the beats.conf included in the Logstash configuration.

input {
 beats {
    type => "beats"
    host => "0.0.0.0"
    port => "5044"
  }
}
output {
    stdout {}
}

Could you please suggest on how can this be fixed. Thanks in Advance.

Upvotes: 2

Views: 1364

Answers (1)

Vamshi Siddarth
Vamshi Siddarth

Reputation: 680

The issue is fixed now. I missed adding the task to copy the beats.conf file to my logstash instance and that was causing the issue. Also, the index, protocol and indices attributes are not required by logstash. Remove these as well and it works absolutely fine now. Thanks leandrojmp :)

Upvotes: 1

Related Questions