Could not find logstash.yml

Elastic Stack Logstash
1

I installed losgatsh 6 in Centos 7 by using RPM installation. when I run

bin/logstash -f /etc/logstash/conf.d/pan.conf

I got the following error
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console

when I use --path.settings="/etc/logstash" it will run successfully

2

I've also bee experiencing this on Ubuntu. If I run it with systemd it works, but running the binary seems to cause it to not find the config file even though it's definitely there. Actually, none of the default settings are there so I have to pass everything in with command line flags.

3

I am trying to run the logstash by

systemctl start logstash

but it is not working.

Can somebody helping me in this issue

4

and you're using sudo?

5

yes and found that there is no logstash file in etc/init.d

6

Below are the error logs

Dec 01 11:57:09 LogServer logstash[22940]: at org.jruby.Main.main(Main.java:204)
Dec 01 11:57:09 LogServer logstash[22940]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@4261e7b] u...r.rolling.Rollin
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)
Dec 01 11:57:09 LogServer logstash[22940]: ... 86 more
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,669 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,670 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,670 main ERROR Unable to locate appender "plain_rolling" for logger config "root"

7

Interesting... I looked in my /etc/init.d and don't see logstash there either. I do see elasticsearch, kibana, and filebeat. Logstash is currently running for me, too. If I run sudo systemctl status logstash it says it is active without errors.

8

Can you run sudo systemctl start logstash && sudo systemctl status logstash and post the output?

9

I stop the service by
systemctl stop logstash

and run again by using ur command
sudo systemctl start logstash && sudo systemctl status logstash
I got these error logs shown from starting the service:

2017-12-01 12:12:14,903 main ERROR FileManager (/var/log/logstash/logstash-plain.log) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied) java.io

2017-12-01 12:12:14,912 main ERROR Unable to invoke factory method in class class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile. java.lang.refle

2017-12-01 12:12:14,920 main ERROR FileManager (/var/log/logstash/logstash-plain.log) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied) java.io

2017-12-01 12:12:14,926 main ERROR Unable to invoke factory method in class class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile. java.lang.refle

2017-12-01 12:12:14,932 main ERROR Null object returned for RollingFile in Appenders.
2017-12-01 12:12:14,933 main ERROR Null object returned for RollingFile in Appenders.
2017-12-01 12:12:14,933 main ERROR Unable to locate appender "plain_rolling" for logger config "root"

10

What does sudo systemctl status logstash output by itself?

11

I run the command as you told me

[root@loguser loguser]# sudo systemctl stop logstash.service
[root@loguser loguser]# sudo systemctl start logstash && sudo systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2017-12-01 12:41:42 CST; 19ms ago
Main PID: 23903 (bash)
CGroup: /system.slice/logstash.service
├─23903 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
├─23917 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
├─23918 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
└─23919 dirname -- /usr/share/logstash/vendor/jruby/bin/jruby

Dec 01 12:41:42 LogServer systemd[1]: Started logstash.
Dec 01 12:41:42 LogServer systemd[1]: Starting logstash...

[root@loguser loguser]# sudo systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2017-12-01 12:41:42 CST; 27s ago
Main PID: 23903 (java)
CGroup: /system.slice/logstash.service
└─23903 /bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfM...

Dec 01 12:42:00 LogServer logstash[23903]: at org.jruby.Main.main(Main.java:204)
Dec 01 12:42:00 LogServer logstash[23903]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@56e9cbee] ...er.rolling.Rolli
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)
Dec 01 12:42:00 LogServer logstash[23903]: ... 86 more
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,019 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,020 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,020 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
Hint: Some lines were ellipsized, use -l to show in full.
[root@loguser loguser]#

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.