search

logstash-plugins / logstash-output-rabbitmq

Apache License 2.0
17 stars 37 forks source link

Logstash refuses to start when 3 or more rabbitmq outputs are used. (message=>"The error reported is: \n) #41

Closed utilitynerd closed 2 years ago

utilitynerd commented 8 years ago

logstash 2.2.2 logstash-output-rabbitmq (3.0.7)

After upgrading to logstash 2.2.0 and updating all plugins, my instance of logstash is refusing to start.

The logstash log only contains: {:timestamp=>"2016-02-22T09:39:49.413000-0800", :message=>"The error reported is: \n "}

Running config test yields: [root@bombay conf.d]# service logstash configtest The error reported is:

After spending some time debugging, I've tracked the issue back to the rabbitmq-output plugin. (The output section of my logstash configuration file is at the end of this post.)

My configuration has 4 separate rabbitmq outputs. Each of these outputs works on it's own (ie. I removed the other 3 rabbitmq outputs). I also tested every permutation using 2 out out 4 outputs and had no issues. However, as soon as I add a third rabbitmq output, I get the error messages above and am unable to start logstash.

logstash.conf output section

output {

if [alert_source] == "u2json" { rabbitmq { exchange => 'snort_events_ex' exchange_type => 'direct' host => '127.0.0.1' key => 'snort_events' vhost => '/sock' user => 'logstash' password => 'sekret' } }

if [alert_source] in ["snort","repsm"] or "udp_syslog" in [tags] { rabbitmq { exchange => 'ids_alerts_ex' exchange_type => 'direct' host => '127.0.0.1' key => 'ids_alerts' vhost => '/sock' user => 'logstash' password => 'sekret' } }

if [dhcp_source] == "standard" or [dhcp_source] == "infoblox" { rabbitmq { exchange => 'dhcp_logs_ex' exchange_type => 'direct' host => '127.0.0.1' key => 'dhcp_logs' vhost => '/sock' user => 'logstash' password => 'sekret' } }

if "infoblox_audit" in [tags] { rabbitmq { exchange => 'infoblox_audit_ex' exchange_type => 'direct' host => '127.0.0.1' key => 'infoblox_audit' vhost => '/sock' user => 'logstash' password => 'sekret' } }

}

andrewvc commented 8 years ago

@utilitynerd thanks for reporting this, that shouldn't happen (obviously). Additionally this is tough to debug thanks to bad error logging in this case (no backtrace). I'll have to try and repro this with a debugger

utilitynerd commented 8 years ago

Any progress on this issue?