Logstash Troubleshooting

1) [ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 173, column 1 (byte 6067) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}

 Resolution : 

 Check the pipeline folder of logstash. There might be some other files or hidden files apart from logstash.yml file.
 So It must be trying to execute the other files. So delete the same.

2) everytime restarted logstash sql_last_value resets

Resolution:

Add below fields in the logstash.conf.
##On the basis of the below field tracking is done so it should be unique and should be in either number or timestamp so that ##it picks the incremental one.
tracking_column => "id"
##This can be numeric or timestamp
tracking_column_type => "numeric"
use_column_value => true
##file where it can write the last value and persist the value on restart
last_run_metadata_path => "/usr/share/logstash/lib/last_run_metadata.log"

3) [logstash.inputs.jdbc ] tracking_column not found in dataset. {:tracking_column=>"LOG_TIME"}

Resolution:

All columns gets converted to lower case after getting into elasticsearch and while using

tracking_column => "LOG_TIME" in caps creates the problem. It should be in lower case
tracking_column => "log_time"