[syslog-ng] "Error initializing message pipeline; plugin name='java', location='#buffer:2:3'" after update to syslog-ng 3.12

[Schoonover, Mark E HHHH]

Try putting mod_java after scl.conf:

@version: 3.13
@include "scl.conf"
@module mod-java

Regards,

Mark Schoonover – KA6WKE
Infrastructure Engineering Manager, Splunk Architect
ENE   : Tools, Instrumentation and Common Services Team
Office: 32.8697° N, 116.9711° W 
Phone : 770-261-7934 
Email : mark.schoonover at cigna.com
HPSM Team: ENE NMS Engineering

Confidential, unpublished property of CIGNA. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. © Copyright 2017 CIGNA


-----Original Message-----
From: syslog-ng [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Roegels Ruben
Sent: Wednesday, December 13, 2017 3:14 AM
To: 'syslog-ng at lists.balabit.hu' <syslog-ng at lists.balabit.hu>
Subject: [syslog-ng] "Error initializing message pipeline; plugin name='java', location='#buffer:2:3'" after update to syslog-ng 3.12

Hi there,

I'm using the OSE of syslog-ng for some weeks.
Today I updated syslog-ng to 3.13 and afterwards I started seeing

-- Unit syslog-ng.service has begun starting up.
Dez 13 11:53:59 syslog syslog-ng[23803]: [2017-12-13T11:53:59.572246] Error initializing message pipeline; plugin name='java', location='#buffer:2:3'
Dez 13 11:53:59 syslog systemd[1]: syslog-ng.service: Main process exited, code=exited, status=2/INVALIDARGUMENT Dez 13 11:53:59 syslog systemd[1]: Failed to start System Logger Daemon.
-- Subject: Unit syslog-ng.service has failed
-- Defined-By: systemd-13T11:53:59.572246] Error initializing message pipeline; plugin name='java', location='#buffer:2:3'

In "journalctl -xe"

If I disable the elasticsearch destination syslog-ng starts up fine.

I don't know what to look at as the error message is not very meaningful to me.
Did I miss some configuration format changes regarding the "elasticsearch2" destination?

The header of my "/etc/syslog-ng/syslog-ng.conf":

=== Snip ===
@version: 3.13
@module mod-java
@include "scl.conf"
=== Snip ===

My elasticsearch config for syslog-ng:
https://urldefense.proofpoint.com/v2/url?u=https-3A__pastebin.com_g6UB3gBi&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=j0-pBHtzrCLaC4o1yVEt7NgevPtS1clX_Ss8HYA5KT4&e=

"ls -l {/usr/share/elasticsearch/lib/,/usr/lib/syslog-ng/3.13/java-modules/}"
https://urldefense.proofpoint.com/v2/url?u=https-3A__pastebin.com_nqYAVhHL&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=rg5uIiB_ZzbcplcjxWttMKrq8Odu5auPxcoGygBi-os&e=

"cat /etc/systemd/system/multi-user.target.wants/syslog-ng.service"
https://urldefense.proofpoint.com/v2/url?u=https-3A__pastebin.com_UzfQXvZL&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=SczLBkdmQeD2gcYn0aw70HRc3supER9Z8ivj63Q9_a4&e=

I really appreciate any help.
Thank you!

Best regards,
Ruben
____________________________________________________________________________
netsys IT GmbH
Ruben Roegels

Nelly-Sachs-Str. 4
79111 Freiburg

Tel. +49 761 888 691 0
Fax  +49 761 888 691 10

<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.netsys-2Dit.de&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=Tq9pR-sVRGFRSX1wGSTFOZ5-NsBDXlWGlyRXFJZz9hs&e=>
Ruben.Roegels at netsys-it.de
____________________________________________________________________________
Amtsgericht Freiburg HRB 5752 Geschaeftsfuehrer: Juergen Dufner

____________________________________________________________________________
______________________________________________________________________________
Member info: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.balabit.hu_mailman_listinfo_syslog-2Dng&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=c8jYvUkj6ug6AnQM-0EefrsCx0qEa-5tKU_crttk-js&e=
Documentation: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_support_documentation_-3Fproduct-3Dsyslog-2Dng&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=GOULwAv1PDfZYRN4P31-e9XIXxtNalO4rlZB9gaDC7o&e=
FAQ: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_wiki_syslog-2Dng-2Dfaq&d=DwIGaQ&c=WlnXFIBCT3pmNh_w8hYeLw&r=7hmZ2rDjdhHVbv2tovCmuIwqUlXIJdVXqIASPRODb2U&m=6NY2nnuYsXmGFB6y5TwPHWmGR_8-MZq5t6aQmsg2vcY&s=XqpRWPf6LrTzjr9ESZGYcOgAYV7W2923U8X2edne7Xw&e=

------------------------------------------------------------------------------
CONFIDENTIALITY NOTICE: If you have received this email in error,
please immediately notify the sender by e-mail at the address shown. 
This email transmission may contain confidential information.  This
information is intended only for the use of the individual(s) or entity to
whom it is intended even if addressed incorrectly.  Please delete it from
your files if you are not the intended recipient.  Thank you for your
compliance.  Copyright (c) 2017 Cigna
==============================================================================