stamparm/maltrail · error · ConfigError

invalid configuration value for 'LOGSTASH_SERVER

Error message

invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')

What it means

LOGSTASH_SERVER accepts multiple endpoints, each of which must be a host:port pair. The parser runs split_endpoints and parse_host_port over each endpoint and bails when an endpoint has no port component.

Solutions

1. Add the port to the endpoint named in the error, e.g. LOGSTASH_SERVER=logstash.example.com:5044.
2. Check each comma-separated endpoint individually — every one must include host:port.
3. Confirm the Logstash input plugin's listening port matches the configured value.
4. Remove the option if Logstash forwarding is not needed.

Example fix

// before (config.conf)
LOGSTASH_SERVER=logstash1.example.com:5044,logstash2.example.com

// after (config.conf)
LOGSTASH_SERVER=logstash1.example.com:5044,logstash2.example.com:5044

let logstash_server = get_str(&raw, "LOGSTASH_SERVER");
for endpoint in logstash_server.split(',') {
    if !endpoint.trim().is_empty() && parse_host_port(endpoint.trim()).1.is_none() {
        eprintln!("LOGSTASH_SERVER endpoint '{endpoint}' lacks a :port");
    }
}

When it happens

Trigger: Setting LOGSTASH_SERVER to one or more addresses where at least one lacks ':port', e.g. LOGSTASH_SERVER=logstash.example.com or LOGSTASH_SERVER=logstash1:5044,logstash2 (second lacks port).

Common situations: Pointing the sensor at a Logstash beats input where the port (commonly 5044) was omitted; load-balanced setups where only the first host got a port; typos like double colons or missing digits in the port.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid USERS entry ' ' [?] (hint: add whitespace at start…
• invalid configuration
• missing configuration file
• missing mandatory option
• invalid configuration value for 'LOG_SERVER

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/73a37a5551a3434e. Report an issue: GitHub.

Appendix: source

Thrown at sensor/src/config.rs:791

        }
        // Either option may name SEVERAL endpoints, so a sensor can feed redundant SIEM
        // collectors (issue #15164). Every one of them is validated: a typo in the second target
        // is exactly as fatal as one in the first, and silently forwarding to one of two
        // configured collectors is the kind of half-working that goes unnoticed for months.
        // Shared secret authenticating LOG_SERVER datagrams. Empty means the previous behaviour:
        // the events go out unsigned and the listener accepts anything that reaches it.
        let log_server_secret = get_str(&raw, "LOG_SERVER_SECRET");

        let syslog_server = get_str(&raw, "SYSLOG_SERVER");
        for endpoint in split_endpoints(&syslog_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'SYSLOG_SERVER' ('{endpoint}')");
            }
        }
        let logstash_server = get_str(&raw, "LOGSTASH_SERVER");
        for endpoint in split_endpoints(&logstash_server) {
            if parse_host_port(endpoint).1.is_none() {
                bail!("invalid configuration value for 'LOGSTASH_SERVER' ('{endpoint}')");
            }
        }
        let remote_severity_regex = get_str(&raw, "REMOTE_SEVERITY_REGEX");
        if !remote_severity_regex.is_empty() && crate::pyre::build_fancy(&remote_severity_regex).is_err() {
            bail!("invalid configuration value for 'REMOTE_SEVERITY_REGEX' ('{remote_severity_regex}')");
        }

        let update_period = match get_u64(&raw, "UPDATE_PERIOD") {
            Some(v) => v,
            None => bail!("invalid configuration value for 'UPDATE_PERIOD' ('{}')", get_str(&raw, "UPDATE_PERIOD")),
        };

        let user_whitelist = {
            let v = get_str(&raw, "USER_WHITELIST");
            if v.is_empty() {
                None
            } else if v.contains(',') {
                crate::cprintln!("[x] configuration value 'USER_WHITELIST' has been changed. Please use it to set location of whitelist file");

View on GitHub (pinned to 77cfb06d76)