{"record":{"id":"73a37a5551a3434e","repo":"stamparm/maltrail","slug":"invalid-configuration-value-for-logstash-server-endpoint","errorCode":null,"errorMessage":"invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')","messagePattern":"invalid configuration value for 'LOGSTASH_SERVER' \\('(.+?)'\\)","errorType":"validation","errorClass":"ConfigError","httpStatus":null,"severity":"error","filePath":"sensor/src/config.rs","lineNumber":791,"sourceCode":"        }\n        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM\n        // collectors (issue #15164). Every one of them is validated: a typo in the second target\n        // is exactly as fatal as one in the first, and silently forwarding to one of two\n        // configured collectors is the kind of half-working that goes unnoticed for months.\n        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:\n        // the events go out unsigned and the listener accepts anything that reaches it.\n        let log_server_secret = get_str(&raw, \"LOG_SERVER_SECRET\");\n\n        let syslog_server = get_str(&raw, \"SYSLOG_SERVER\");\n        for endpoint in split_endpoints(&syslog_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')\");\n            }\n        }\n        let logstash_server = get_str(&raw, \"LOGSTASH_SERVER\");\n        for endpoint in split_endpoints(&logstash_server) {\n            if parse_host_port(endpoint).1.is_none() {\n                bail!(\"invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')\");\n            }\n        }\n        let remote_severity_regex = get_str(&raw, \"REMOTE_SEVERITY_REGEX\");\n        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {\n            bail!(\"invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')\");\n        }\n\n        let update_period = match get_u64(&raw, \"UPDATE_PERIOD\") {\n            Some(v) => v,\n            None => bail!(\"invalid configuration value for 'UPDATE_PERIOD' ('{}')\", get_str(&raw, \"UPDATE_PERIOD\")),\n        };\n\n        let user_whitelist = {\n            let v = get_str(&raw, \"USER_WHITELIST\");\n            if v.is_empty() {\n                None\n            } else if v.contains(',') {\n                crate::cprintln!(\"[x] configuration value 'USER_WHITELIST' has been changed. Please use it to set location of whitelist file\");","sourceCodeStart":773,"sourceCodeEnd":809,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/config.rs#L773-L809","documentation":"LOGSTASH_SERVER accepts multiple endpoints, each of which must be a host:port pair. The parser runs split_endpoints and parse_host_port over each endpoint and bails when an endpoint has no port component.","triggerScenarios":"Setting LOGSTASH_SERVER to one or more addresses where at least one lacks ':port', e.g. LOGSTASH_SERVER=logstash.example.com or LOGSTASH_SERVER=logstash1:5044,logstash2 (second lacks port).","commonSituations":"Pointing the sensor at a Logstash beats input where the port (commonly 5044) was omitted; load-balanced setups where only the first host got a port; typos like double colons or missing digits in the port.","solutions":["Add the port to the endpoint named in the error, e.g. LOGSTASH_SERVER=logstash.example.com:5044.","Check each comma-separated endpoint individually — every one must include host:port.","Confirm the Logstash input plugin's listening port matches the configured value.","Remove the option if Logstash forwarding is not needed."],"exampleFix":"// before (config.conf)\nLOGSTASH_SERVER=logstash1.example.com:5044,logstash2.example.com\n\n// after (config.conf)\nLOGSTASH_SERVER=logstash1.example.com:5044,logstash2.example.com:5044","handlingStrategy":"validation","validationCode":"let logstash_server = get_str(&raw, \"LOGSTASH_SERVER\");\nfor endpoint in logstash_server.split(',') {\n    if !endpoint.trim().is_empty() && parse_host_port(endpoint.trim()).1.is_none() {\n        eprintln!(\"LOGSTASH_SERVER endpoint '{endpoint}' lacks a :port\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Record the Logstash input port (commonly 5044) alongside hostnames.","Test connectivity with nc to host:port before deploying.","Validate every endpoint in multi-collector setups, not just the first."],"tags":["rust","configuration","logstash"],"backgroundTag":"invalid-config-value","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}