How to properly configure Logstash on windows

14 Views Asked by At

I have installed Logstash on a Windows 11 OS. I gave it the following pipeline configuration just to test things out:

# Read logs from a file
input {
  file {
    path => "C:\dev\my_app.log"
  }
}

# Print processed events to standard output
output {
  stdout {
    codec => plain { format => "%{message}" }
  }
}

I added the following context into my_app.log file:

2024-03-18 10:52:13 INFO  [my_app.startup] Application started successfully
2024-03-18 10:53:27 DEBUG [user.login] User with ID: 123 logged in successfully
2024-03-18 10:54:01 WARNING [data.validation] Invalid input data received. Field: name
2024-03-18 10:54:15 ERROR  [database.connection] Failed to connect to the database. Reason: Timeout
2024-03-18 10:55:00 INFO  [job.processing] Job with ID: XYZ completed successfully

I then started the Logstash as follows:

C:\dev\logstash-8.12.2>bin\logstash -f ..\logstash.conf

I do not see any obvious errors, but I do not see the expected output either:

C:\dev\logstash-8.12.2>bin\logstash -f ..\logstash.conf
"Using bundled JDK: C:\dev\logstash-8.12.2\jdk\bin\java.exe"
C:/dev/logstash-8.12.2/vendor/bundle/jruby/3.1.0/gems/concurrent-ruby-1.1.9/lib/concurrent-ruby/concurrent/executor/java_thread_pool_executor.rb:13: warning: method redefined; discarding old to_int
C:/dev/logstash-8.12.2/vendor/bundle/jruby/3.1.0/gems/concurrent-ruby-1.1.9/lib/concurrent-ruby/concurrent/executor/java_thread_pool_executor.rb:13: warning: method redefined; discarding old to_f
Sending Logstash logs to C:/dev/logstash-8.12.2/logs which is now configured via log4j2.properties
[2024-03-18T11:25:10,374][INFO ][logstash.runner          ] Log4j configuration path used is: C:\dev\logstash-8.12.2\config\log4j2.properties
[2024-03-18T11:25:10,390][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"8.12.2", "jruby.version"=>"jruby 9.4.5.0 (3.1.4) 2023-11-02 1abae2700f OpenJDK 64-Bit Server VM 17.0.10+7 on 17.0.10+7 +indy +jit [x86_64-mswin32]"}
[2024-03-18T11:25:10,406][INFO ][logstash.runner          ] JVM bootstrap flags: [-XX:+HeapDumpOnOutOfMemoryError, -Dlogstash.jackson.stream-read-constraints.max-number-length=10000, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, -Djruby.regexp.interruptible=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11, -Dlog4j2.isThreadContextMapInheritable=true, -Xms1g, -Dlogstash.jackson.stream-read-constraints.max-string-length=200000000, -Djdk.io.File.enableADS=true, -Dfile.encoding=UTF-8, --add-opens=java.base/java.io=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, -Djruby.compile.invokedynamic=true, -Xmx1g, -Djava.security.egd=file:/dev/urandom, -Djava.awt.headless=true, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED]
[2024-03-18T11:25:10,421][INFO ][logstash.runner          ] Jackson default value override `logstash.jackson.stream-read-constraints.max-string-length` configured to `200000000`
[2024-03-18T11:25:10,421][INFO ][logstash.runner          ] Jackson default value override `logstash.jackson.stream-read-constraints.max-number-length` configured to `10000`
[2024-03-18T11:25:10,580][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2024-03-18T11:25:13,697][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2024-03-18T11:25:14,242][INFO ][org.reflections.Reflections] Reflections took 354 ms to scan 1 urls, producing 132 keys and 468 values
[2024-03-18T11:25:15,385][INFO ][logstash.javapipeline    ] Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise.
[2024-03-18T11:25:15,454][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["C:/dev/logstash.conf"], :thread=>"#<Thread:0x312f4c17 C:/dev/logstash-8.12.2/logstash-core/lib/logstash/java_pipeline.rb:134 run>"}
[2024-03-18T11:25:16,737][INFO ][logstash.javapipeline    ][main] Pipeline Java execution initialization time {"seconds"=>1.28}
[2024-03-18T11:25:16,816][INFO ][logstash.inputs.file     ][main] No sincedb_path set, generating one based on the "path" setting {:sincedb_path=>"C:/dev/logstash-8.12.2/data/plugins/inputs/file/.sincedb_09df14b4e1cad661836f2fe0fdc15314", :path=>["C:\\dev\\my_app.log"]}
[2024-03-18T11:25:16,831][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id"=>"main"}
[2024-03-18T11:25:16,882][INFO ][filewatch.observingtail  ][main][3ac8eadd4c05fad9d29727c6e493fe4fb6aee1c76be788e46f0ed39b26c38e2d] START, creating Discoverer, Watch with file and sincedb collections
[2024-03-18T11:25:16,901][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

What am I doing wrong here?

0

There are 0 best solutions below