After upgrading Logstash to 6.4.1 It could not be started there is already another instance using the configured data directory

Elastic Stack Logstash
1

Hi,
After upgrading Logstash to version 6.4.1 using the package managers procedure bellow :
https://www.elastic.co/guide/en/logstash/current/upgrading-using-package-managers.html

Logstash version has changed successfully to 6.4.1 using ./logstash -V command , but did't show up on kibana logstash list.

So I enabled the debug mode on logstash.yml file and got this message Error telling me that there is more than one instance on my server :

[2018-09-26T15:05:17,514][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2018-09-26T15:05:17,539][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Knowing that i did't configure multiple instances of logstash and i have only one logstash.yml file and one path.data specified in it.

need your help please
Thanks,
Emna.

2

Are you using a service manager to run Logstash, or are you invoking it directly on the command line? Is it possible that you have it running in a different shell, or that the service manager has one running?

On Linux, it is possible to find a running process by name with ps aux | grep -i logstash.

3

Thanks for your return :slight_smile:
Im invoking it directly on the command line.
I already tried your command and got more than one process and tried to kill the process with kill -9 command but it won't always work for me .
So my current situation is that : sometimes the logstash appears on kibana and most of the time is not there and when ever it appears it has : 0 Events Ingested
any help ?
Thanks,
Emna.

4

My best guess is that your service manager is attempting to manage the service, so each time you kill it, the service manager brings it back up. I would advise tailing the logs to see what it is doing, and/or using your system's service manager to shut it down.

5

I enabled the debug mode on logstash.yml file and tailed the log

This is the result :
[2018-09-28T11:13:04,148][DEBUG][logstash.runner ] xpack.monitoring.elasticsearch.username: "logstash_system"
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] xpack.monitoring.elasticsearch.ssl.verification_mode: "certificate"
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] xpack.monitoring.elasticsearch.sniffing: false
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] xpack.monitoring.collection.pipeline.details.enabled: true
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] xpack.monitoring.collection.config.enabled: true
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] node.uuid: ""
[2018-09-28T11:13:04,149][DEBUG][logstash.runner ] --------------- Logstash Settings -------------------
[2018-09-28T11:13:04,199][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=>"/etc/logstash/pipelines.yml"}
[2018-09-28T11:13:04,241][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2018-09-28T11:13:04,251][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

i got the same result when i run this command
/usr/share/logstash/bin/logstash --path.settings /etc/logstash --debug

Thanks,
Emna.

6

Have you tried telling your service manager to stop the service?

7

Yes i did , i used this command systemctl stop logstash
I made sure to kill other processes using : killall -9 --user user_name
The logstash is active and stable on kibana but like i mentioned is not ingesting any events ( 0 Events Received and 0 Events Emitted )

8

I'm working with 6.4.1 version for Elasticsearch , kibana and logstash but still working with a previous version for winlogbeats that i have installed on my Active directory servers.

Could it be a version compatibility problem ?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.