Logstash plugin for Log Analytics workspace stopped functioning

Abiodun Odewale 0 Reputation points
2025-03-12T16:09:34.1466667+00:00

Logstash got stuck trying to process logs to sentinel with the output below:

log-analytics-logstash-output-plugin-1.1.4/lib/logstash/sentinel_la/logsSender.rb:5: warning: parentheses after method name is interpreted as an argument list, not a decomposed argument

[INFO ] 2025-03-12 15:51:00.970 [Converge PipelineAction::Create<main>] javapipeline - Pipeline main is configured with pipeline.ecs_compatibility: v8 setting. All plugins in this pipeline will default to ecs_compatibility => v8 unless explicitly configured otherwise.

[INFO ] 2025-03-12 15:51:01.000 [[main]-pipeline-manager] microsoftsentineloutput - Azure Loganalytics configuration was found valid.

[INFO ] 2025-03-12 15:51:01.037 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/sentinel.conf"], :thread=>"#<Thread:0x67dcf180 /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:138 run>"}

[INFO ] 2025-03-12 15:51:01.720 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>0.68}

[INFO ] 2025-03-12 15:51:01.743 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}

[INFO ] 2025-03-12 15:51:01.748 [[main]<file] observingtail - START, creating Discoverer, Watch with file and sincedb collections

[INFO ] 2025-03-12 15:51:01.764 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,242 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Abiodun Odewale 0 Reputation points
    2025-03-12T16:58:27.29+00:00

    I am having the some issues using the sentinel output plugin for logstash. The logstash got stuck as below:

    log-analytics-logstash-output-plugin-1.1.4/lib/logstash/sentinel_la/logsSender.rb:5: warning: parentheses after method name is interpreted as an argument list, not a decomposed argument

    [INFO ] 2025-03-12 15:51:00.970 [Converge PipelineAction::Create<main>] javapipeline - Pipeline main is configured with pipeline.ecs_compatibility: v8 setting. All plugins in this pipeline will default to ecs_compatibility => v8 unless explicitly configured otherwise.

    [INFO ] 2025-03-12 15:51:01.000 [[main]-pipeline-manager] microsoftsentineloutput - Azure Loganalytics configuration was found valid.

    [INFO ] 2025-03-12 15:51:01.037 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/sentinel.conf"], :thread=>"#<Thread:0x67dcf180 /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:138 run>"}

    [INFO ] 2025-03-12 15:51:01.720 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>0.68}

    [INFO ] 2025-03-12 15:51:01.743 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}

    [INFO ] 2025-03-12 15:51:01.748 [[main]<file] observingtail - START, creating Discoverer, Watch with file and sincedb collections

    [INFO ] 2025-03-12 15:51:01.764 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

    0 comments No comments

  2. Andrew Blumhardt 9,876 Reputation points Microsoft Employee
    2025-03-12T21:06:35.8233333+00:00

    I have not worked with the Logstash plugin but I assume troubleshooting is not unlike the AMA agent. Verify that you have the latest version. Verify network connectivity to the workspace endpoint(s). Consider that the workspace endpoint may be having issues.

    If this was working, then stopped, it may be a workspace, backend issue that may be detected and resolved in time or there may have been a network change. You can work to verify that it isn't a firewall block on your end and wait for a resolution or report a support case if you have Microsoft support.

    If this never worked or you are trying for the first time, the issue is more likely local. You might consider loading Azure Arc and AMA just to verify network connectivity. If AMA cannot reach the workspace, the plugin will likely have the same issue. There are good troubleshooting tools for the AMA client that can be use to verify connectivity.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.