Azure / Azure/azure-diagnostics-tools

Getting Error while using SinceDB in azure blob plugin.

Open
#165 6 comments 0 reactions 0 assignees View on GitHub
logstash-input-azureblobs
Dominant language
Ruby
Stars
101
Forks
93
PR merge metrics
No merged PRs in 30d

Description

I am using AzureBlob Plugin to pull the logs of NSG Flow Logs and Azure ActivityLogs to the same ELK instance. My Plugin Input Configuration for the following Logs are as follows.
**NSG Flow Logs:**
input {
azureblob
{
storage_account_name => "test1"
storage_access_key => "xxxxxxxxxxxxxxx"
container => "insights-logs-networksecuritygroupflowevent"
codec => "json"
type => "nsg_flow_logs"
# Refer https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-read-nsg-flow-logs
# Typical numbers could be 21/9 or 12/2 depends on the nsg log file types
file_head_bytes => 12
file_tail_bytes => 2
sincedb => "/usr/share/logstash/data/nsg_flow_logs_sincedb"
}
}

**For Azure Activity Logs:**
input {
azureblob
{
storage_account_name => "test2"
storage_access_key => "yyyyyyy"
container => "insights-operational-logs"
codec => "json"
type => "activitylogs"
sincedb => "/usr/share/logstash/data/azure_activity_logs_sincedb"
}
}

**But the Logstash is throwing the following error:**
[2018-08-27T06:09:28,137][ERROR][logstash.inputs.logstashinputazureblob] Unknown setting 'sincedb' for azureblob
[2018-08-27T06:09:28,146][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Something is wrong with your configuration.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:89:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:62:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:97:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:110:in `plugin'", "(eval):8:in `'", "org/jruby/RubyKernel.java:994:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:82:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}

But I did found that **sincedb** is acceptable setting for the azure blob plugin. So what is wrong in my configuration.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.