Hi,
I am unable to push data in to ES from logstash when using logstash user. it starts giving belwo error
Attempted to resurrect connection to dead ES instance, but got an error. {:url=>“http://logstash:xxxxxx@localhost:9200/”,
But when i try to use kibna user instead of logstash it works fine.
Below is my logstash.conf file
input {
jdbc {
jdbc_driver_library => “/Users/usmanniazi/Downloads/logstash-7.7.0/db2jcc4.jar”
jdbc_driver_class => “com.ibm.db2.jcc.DB2Driver”
jdbc_connection_string => “jdbc:db2://host:port/db”
jdbc_user => “user”
jdbc_password => “pass”
#ssl_key => “/home/mesadmin/Downloads/logstash-7.6.2/hwsw360.w3-969.ibm.com.key”
#ssl_certificate => “/home/mesadmin/Downloads/logstash-7.6.2/cert.crt”
#last_run_metadata_path => “/home/mesadmin/Downloads/logstash-7.6.2/.logstash_jdbc_last_run”
#use_column_value => “true”
#tracking_column => “insert_ts”
#tracking_column_type => “timestamp”
#tracking_column => “_sequence_key”
statement_filepath => “/Users/usmanniazi/Downloads/logstash-7.7.0/ilm.sql”
#schedule => “* * * * *”
}
}
output {
elasticsearch {
hosts => [“localhost:9200”]
index => “ilm_data”
user => [“logstash”]
password => [“logstash”]
}
}
and below is my logstash user configuration in ROR.yml file
- name: "Logstash can write and create its own indices"
auth_key: logstash:logstash
type: allow
# kibana_access: ro
actions: ["indices:data/read/*","indices:data/write/*","indices:admin/template/*","indices:admin/create"]
indices: ["logstash-*","ilm_data",".kibana*","<no-index>"]