# Could not find or load main class logstash **URL:** \ **Category:** Logstash\ **Created:** [May 11, 2017, 6:54am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337 "2017-05-11T06:54:53Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 6:54am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/1 "2017-05-11T06:54:53Z")
Dear All, I am trying to load some data into Kibana using Logstash. I searched on the internet about it and I found a sample how to load the data from this link : [https://github.com/elastic/examples/tree/master/ElasticStack\_apache](https://github.com/elastic/examples/tree/master/ElasticStack_apache) However when I try to run a command to load sample logs into Elasticsearch, I have got this error: ![](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a5c769d760ec4e21b4a4a133ca5c2ff6194df00.png) And, this is return values from [http://localhost:9200/\_cat/indices?v:](http://localhost:9200/_cat/indices?v:) ![](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be8ea3139d3b4ef78bd01a030977725e71c09a11.PNG) Anyway, I run Kibana from Windows 10 pc. Any ideas how to solve this issue? Thank You. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 7:03am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/2 "2017-05-11T07:03:29Z")
It doesn't run with java like this Just remove it (use logstash as it is a .bat file) ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 8:10am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/3 "2017-05-11T08:10:40Z")
Hi Nico, I am still have an error: ![](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5fa4ef481c9dc876a01c0aca50e68f48fd117de7.png) Do you know what error is that? ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 8:19am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/4 "2017-05-11T08:19:24Z")
As magnus answered there: > [@Unrecognized option: Files\\Elasticsearch\\Logstash/heapdump.hprof"](https://discuss.elastic.co/t/unrecognized-option-files-elasticsearch-logstash-heapdump-hprof/77576): > > Hello, I'm working to install a brand new ELK stack. Following the installation of Logstash on 2012R2, I attempted to test it with the following command: logstash -e 'input { stdin { } } output { stdout {} }' I received the following error: Unrecognized option: Files\Elasticsearch\Logstash/heapdump.hprof" JVM creation failed I have no idea where to go from here. Any help would be greatly appreciated. And if you check a bit around, you'll see that if logstash is installed in a dir with a space: it will fail. So rename your folder or move logstash in other dir. (Btw, as a linux fan, I recommend you, when you work, to never use folder with space, replace them with \_, and the same with -. It can sometime save you) ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 9:14am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/5 "2017-05-11T09:14:55Z")
Hi Nico, I have change the directory with no space. However I have got another error: ![](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e960b0a4aafcbb73b1b3678045cbbe393a0a5a6.png) And, when I go to [http://localhost:9200/apache\_elastic\_example/\_count](http://localhost:9200/apache_elastic_example/_count) to verify, I have this message: ![](https://us1.discourse-cdn.com/elastic/original/3X/5/5/5567eba098c8e2642900fa4129f19d7e76549657.PNG) Any setting that I missed? ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 9:17am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/6 "2017-05-11T09:17:19Z")
can you copy/paste your config file? (with indentation and using formatted text?) And I suppose you have x-pack? ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 9:20am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/7 "2017-05-11T09:20:05Z")
Do you mean apache\_logstash.conf? Here it is: ``` input { stdin { } } filter { grok { match => { "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}' } } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] locale => en } geoip { source => "clientip" } useragent { source => "agent" target => "useragent" } } output { stdout { codec => dots {} } elasticsearch { index => "apache_elastic_example" template => "./apache_template.json" template_name => "apache_elastic_example" template_overwrite => true } } ``` Yes, I have installed the x-pack. Thank You. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 9:23am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/8 "2017-05-11T09:23:16Z")
Then you just need to configure X-Pack correctly, as it says to you that the user kibana (the one your trying to do a lookup with) as not the correct right to do this. I advise you to check its role and how to configure it correctly ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 9:44am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/9 "2017-05-11T09:44:18Z")
Hi Nico, I have change to elastic user as superuser. When I run the command, I am still got the same error, but when I go to [http://localhost:9200/apache\_elastic\_example/\_count](http://localhost:9200/apache_elastic_example/_count), I have this error instead: ![](https://us1.discourse-cdn.com/elastic/original/3X/6/6/6674773f5cca7f2e5853867666e422b67c816f82.PNG) Any ideas? Thank You. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 9:46am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/10 "2017-05-11T09:46:48Z")
It tells you that the index apache\_elastic\_example does not exists You can check the existing indices here: **[http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v)** As for logstash, you might have to configure it (check here for instance: [https://www.elastic.co/guide/en/x-pack/5.4/logstash.html](https://www.elastic.co/guide/en/x-pack/5.4/logstash.html)) to allow it to write ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 9:50am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/11 "2017-05-11T09:50:52Z")
I see, this is the return from [http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v) ![](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3aa294e710b84048469b47df679ba1778ef8e4b.PNG) Did I missed something? I just put the files inside logstash bin folder: ![](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d028fa731968456d8797ec93050a430d9cb2eb53.png) All the sample files I get from [https://github.com/elastic/examples/tree/master/ElasticStack\_apache](https://github.com/elastic/examples/tree/master/ElasticStack_apache) Thank You. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 11, 2017, 9:53am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/12 "2017-05-11T09:53:36Z")
> [@Nico-DF](#): > > As for logstash, you might have to configure it (check here for instance: [Logstash and Security | X-Pack for the Elastic Stack [5.4] | Elastic](https://www.elastic.co/guide/en/x-pack/5.4/logstash.html)) to allow it to write I append this to my last comment. Logstash user might not have the right to create template, write index, etc, as the response code is 401: unauthorized I can only tell you that. For further info on x-pack and configuration, I can't really help you. If you don't find the solution, you'll have to wait for someone else ---
**Author:** ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Post date:** [May 11, 2017, 9:56am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/13 "2017-05-11T09:56:18Z")
I see. Okay then. I will try to configure it. Thanks Nico! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 8, 2017, 10:07am UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-logstash/85337/14 "2017-06-08T10:07:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.