# Could not find logstash.yml
**URL:** https://discuss.elastic.co/t/could-not-find-logstash-yml/109834
**Category:** Logstash
**Created:** [November 30, 2017, 9:03pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834 "2017-11-30T21:03:25Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [November 30, 2017, 9:03pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/1 "2017-11-30T21:03:25Z")
I installed losgatsh 6 in Centos 7 by using RPM installation. when I run
bin/logstash -f /etc/logstash/conf.d/pan.conf
I got the following error
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
when I use --path.settings="/etc/logstash" it will run successfully
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 1, 2017, 3:43pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/2 "2017-12-01T15:43:01Z")
I've also bee experiencing this on Ubuntu. If I run it with systemd it works, but running the binary seems to cause it to not find the config file even though it's definitely there. Actually, none of the default settings are there so I have to pass everything in with command line flags.
---
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [December 1, 2017, 5:32pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/3 "2017-12-01T17:32:58Z")
I am trying to run the logstash by
systemctl start logstash
but it is not working.
Can somebody helping me in this issue
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 1, 2017, 5:51pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/4 "2017-12-01T17:51:40Z")
and you're using sudo?
---
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [December 1, 2017, 5:53pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/5 "2017-12-01T17:53:38Z")
yes and found that there is no logstash file in etc/init.d
---
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [December 1, 2017, 5:58pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/6 "2017-12-01T17:58:32Z")
Below are the error logs
Dec 01 11:57:09 LogServer logstash[22940]: at org.jruby.Main.main(Main.java:204)
Dec 01 11:57:09 LogServer logstash[22940]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@4261e7b] u...r.rolling.Rollin
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)
Dec 01 11:57:09 LogServer logstash[22940]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)
Dec 01 11:57:09 LogServer logstash[22940]: ... 86 more
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,669 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,670 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 11:57:09 LogServer logstash[22940]: 2017-12-01 11:57:09,670 main ERROR Unable to locate appender "plain\_rolling" for logger config "root"
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 1, 2017, 6:01pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/7 "2017-12-01T18:01:08Z")
Interesting... I looked in my /etc/init.d and don't see logstash there either. I do see elasticsearch, kibana, and filebeat. Logstash is currently running for me, too. If I run `sudo systemctl status logstash` it says it is active without errors.
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 1, 2017, 6:02pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/8 "2017-12-01T18:02:38Z")
Can you run `sudo systemctl start logstash && sudo systemctl status logstash` and post the output?
---
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [December 1, 2017, 6:19pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/9 "2017-12-01T18:19:06Z")
I stop the service by
systemctl stop logstash
and run again by using ur command
sudo systemctl start logstash && sudo systemctl status logstash
I got these error logs shown from starting the service:
2017-12-01 12:12:14,903 main ERROR FileManager (/var/log/logstash/logstash-plain.log) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied) [java.io](http://java.io)
2017-12-01 12:12:14,912 main ERROR Unable to invoke factory method in class class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile. java.lang.refle
2017-12-01 12:12:14,920 main ERROR FileManager (/var/log/logstash/logstash-plain.log) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied) [java.io](http://java.io)
2017-12-01 12:12:14,926 main ERROR Unable to invoke factory method in class class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile. java.lang.refle
2017-12-01 12:12:14,932 main ERROR Null object returned for RollingFile in Appenders.
2017-12-01 12:12:14,933 main ERROR Null object returned for RollingFile in Appenders.
2017-12-01 12:12:14,933 main ERROR Unable to locate appender "plain\_rolling" for logger config "root"
---
### Author:  [@arisbanach](https://discuss.elastic.co/u/arisbanach)
#### Post date: [December 1, 2017, 6:40pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/10 "2017-12-01T18:40:36Z")
What does `sudo systemctl status logstash` output by itself?
---
### Author:  [@saad](https://discuss.elastic.co/u/saad)
#### Post date: [December 1, 2017, 6:55pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/11 "2017-12-01T18:55:56Z")
I run the command as you told me
[root@loguser loguser]# sudo systemctl stop logstash.service
[root@loguser loguser]# sudo systemctl start logstash && sudo systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2017-12-01 12:41:42 CST; 19ms ago
Main PID: 23903 (bash)
CGroup: /system.slice/logstash.service
├─23903 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
├─23917 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
├─23918 bash /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
└─23919 dirname -- /usr/share/logstash/vendor/jruby/bin/jruby
Dec 01 12:41:42 LogServer systemd[1]: Started logstash.
Dec 01 12:41:42 LogServer systemd[1]: Starting logstash...
[root@loguser loguser]# sudo systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2017-12-01 12:41:42 CST; 27s ago
Main PID: 23903 (java)
CGroup: /system.slice/logstash.service
└─23903 /bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfM...
Dec 01 12:42:00 LogServer logstash[23903]: at org.jruby.Main.main(Main.java:204)
Dec 01 12:42:00 LogServer logstash[23903]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@56e9cbee] ...er.rolling.Rolli
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)
Dec 01 12:42:00 LogServer logstash[23903]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)
Dec 01 12:42:00 LogServer logstash[23903]: ... 86 more
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,019 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,020 main ERROR Null object returned for RollingFile in Appenders.
Dec 01 12:42:00 LogServer logstash[23903]: 2017-12-01 12:42:00,020 main ERROR Unable to locate appender "plain\_rolling" for logger config "root"
Hint: Some lines were ellipsized, use -l to show in full.
[root@loguser loguser]#
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2017, 6:56pm UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml/109834/12 "2017-12-29T18:56:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.