Error 8.5.0 running as systemctl service

Elastic Stack Logstash
1

I have a new installation of logstash 8.5.0 at Alma 9 from the repo
When I run logstash as user logstash from the command line everything works as expocted

sudo -u logstash /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"

[2022-11-07T01:06:03,370][INFO ][logstash.javapipeline    ][.monitoring-logstash] Pipeline Java execution initialization time {"seconds"=>0.45}
[2022-11-07T01:06:03,447][INFO ][logstash.javapipeline    ][.monitoring-logstash] Pipeline started {"pipeline.id"=>".monitoring-logstash"}
[2022-11-07T01:06:03,499][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id"=>"main"}
[2022-11-07T01:06:03,558][INFO ][logstash.agent           ] Pipelines running {:count=>2, :running_pipelines=>[:".monitoring-logstash", :main], :non_running_pipelines=>[]}

When I start logstash as service ( systemctl start logstash ) it starts an endless loop of remove pipelines , shutting down and restartng.

[2022-11-07T00:58:44,378][INFO ][logstash.pipelinesregistry] Removed pipeline from registry successfully {:pipeline_id=>:".monitoring-logstash"}
[2022-11-07T00:58:44,424][INFO ][logstash.runner          ] Logstash shut down.
...

the pipelines.yml , logstash.yml are default , I have only a minimum stdin.stdout conf file for testing. I test and search almost anything without success .
Thanks, George Bouras

2

Are you using stdin as the input while running it a a service?

Try to change to tcp input with a random port, since there is no input for stdin when you run Logstash as a service, so the pipeline may not work as expected.

Test with something like this:

input {
    tcp {
        port => "10000"
    }
}
3

Using the tcp input as you advised the service restart loop stopped.

Actually we have many pipelines at 8.5.0 that working fine at our kubernetes.
The problem arised when I install it as rpm for development and trying to verify the basic functionality.

thanks for you help.
G. Bouras

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.