Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pipeline from is down #42

Open
blackbrownco opened this issue Nov 17, 2022 · 3 comments
Open

Pipeline from is down #42

blackbrownco opened this issue Nov 17, 2022 · 3 comments

Comments

@blackbrownco
Copy link

Hi could you help to resolve this issue.
I have copied all the template, dashboard json, pipelines.yml, all the .conf files to my vm that already fresh-installed Elasticsearch and Kibana. There is an issue on starting Logstash service, there is a warning

logstash[8167]: [2022-11-17T13:20:39,686][WARN ][org.logstash.plugins.pipeline.PipelineBus][syslog-fortinet-fortigate_2_ecs][320c3995cf79ebc0724f34bd360b3e9193d7d44220d69c92749327fb9930cde9] Attempted to send event to 'syslog-fortinet-common_ecs-output' but that address was unavailable. Maybe the destination pipeline is down or stopping? Will Retry.

I've already modified the output {} and point it to my elasticsearch server gave the user and password also enabled the SSL and point the certificate to elasticsearch's http_ca.crt as well.

@enotspe
Copy link
Owner

enotspe commented Nov 17, 2022

Have you installed the tld filter???

https://github.com/enotspe/fortinet-2-elasticsearch#on-logstash

@francesco-amato-argo
Copy link

Hi
I know that the last post is quite old but I have the same problem
After many tests, I found the culprit
If I comment tld directive in syslog-fortinet-common_ecs-output file logstash service starts normally and the syslog-fortinet-common_ecs-output pipeline starts too

This is the error message that I read with tld filters

<ArgumentError: wrong number of arguments (given 2, expected 1)>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/public_suffix-3.1.1/lib/public_suffix/list.rb:69:

I run ES 8.10 with logstash 8.10
I have installed logstash-filter-tld

@enotspe
Copy link
Owner

enotspe commented Oct 19, 2023

that is a different error. please open a new issue and post the full error log. It seems that you are passing an array to a function that just expects one value

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants