Try PubSub+

Solace broker and ELK integration

I am not able to apply solace gork pattern(Solace event log) on logstash config file

if [type] == "syslog" { grok { match => { "message" => "%{SOLACE_EVENT_LOG}" } } syslog_pri {} }

Tagged:

Comments

  • AaronAaron Member, Moderator, Employee Posts: 133 Solace Employee

    Hi @Kinjal Shah !

    Here's one of my logstash config files. It might be a bit complicated, but it should give you some pointers. https://github.com/aaron-613/solace-logging-config/blob/master/solace_logstash.conf
    Other options are here, and a bit of a write-up: https://github.com/aaron-613/solace-logging-config/

    BTW, did you try Googling for just "solace logstash"? Here are a couple other resources from our webpage:
    Blog: https://solace.com/blog/integrating-solace-with-logstash/
    Integration Guide: https://docs.solace.com/Developer-Tools/Integration-Guides/Elk-Stack.htm

  • AaronAaron Member, Moderator, Employee Posts: 133 Solace Employee

    Double post! Just saw your other one. Ok: did you notice the Appendix (appendices) at teh end of the PDF document? All the various patterns are defined there, and a full config file is given.

    If you've copy-pasted all of those from the Appendix, is your Logstash giving any errors? grok rules parsing errors..?

  • Kinjal ShahKinjal Shah Member Posts: 9

    getting below error if I copy the logstash config file provided in appendix in pdf

    Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: create at org/logstash/execution/ConvergeResultExt.java:129
    Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: add at org/logstash/execution/ConvergeResultExt.java:57
    Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: converge_state at /usr/share/logstash/logstash-core/lib/logstash/agent.rb:355
    Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: [2020-10-28T13:13:47,675][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle Java::JavaLang::IllegalStateException for PipelineAction::Create<main>", :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in create'", "org/logstash/execution/ConvergeResultExt.java:57:inadd'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:355:in block in converge_state'"]} Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: [2020-10-28T13:13:47,684][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handleJava::JavaLang::IllegalStateExceptionforPipelineAction::Create

    >, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:increate'", "org/logstash/execution/ConvergeResultExt.java:57:in add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:355:inblock in converge_state'"]}
    Oct 28 13:13:47 ip-172-32-2-49.us-east-2.compute.internal logstash[3847]: [2020-10-28T13:13:47,736][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
  • Kinjal ShahKinjal Shah Member Posts: 9

    Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:126)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:80)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:82)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$VARARGS(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:82)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}

  • Kinjal ShahKinjal Shah Member Posts: 9

    its unable to configure pipeline

  • marcmarc Member, Administrator, Moderator, Employee Posts: 207 admin
    edited October 30

    @arih I believe you were recently using Solace + ELK. Any chance you ran into this issue or know what we might be missing?

    It looks like @Kinjal Shah is having an issue trying to get the Solace Grok patterns working for event logs that are defined in the appendix of the integration guide

  • ariharih Member, Employee Posts: 43 Solace Employee

    Hi @marc ,

    My blog post talks about the other side of the integration - where Logstash consumes logs from Solace Queue using JMS. So I didn't play around with config like what @Kinjal Shah and @Aaron did.

Sign In or Register to comment.