# ERROR Null object returned for RollingFile in Appenders

**URL:** <https://discuss.elastic.co/t/error-null-object-returned-for-rollingfile-in-appenders/103990>\
**Category:** Logstash\
**Created:** [October 14, 2017, 12:32pm UTC](https://discuss.elastic.co/t/error-null-object-returned-for-rollingfile-in-appenders/103990 "2017-10-14T12:32:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bo8888](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@bo8888](https://discuss.elastic.co/u/bo8888)\
**Post date:** [October 14, 2017, 12:32pm UTC](https://discuss.elastic.co/t/error-null-object-returned-for-rollingfile-in-appenders/103990/1 "2017-10-14T12:32:13Z")

</div>

hi,  
i need help

logstash-5.6.2

[root@bogon ~]# java -version  
java version "1.8.0\_121"  
Java(TM) SE Runtime Environment (build 1.8.0\_121-b13)  
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)

[root@bogon ~]# cat /etc/logstash/conf.d/nginx.conf  
input {  
file {  
path =\> "/var/log/nginx/access.log"  
codec =\> json  
}  
}  
output {  
elasticsearch {  
hosts=\>["192.168.23.139:9200"]  
index =\> "logstash-%{type}-%{+YYYY.MM.dd}"  
document\_type =\> "%{type}"  
flush\_size =\> 1  
idle\_flush\_time =\> 10  
sniffing =\> true  
template\_overwrite =\> true  
user =\> "elastic"  
password =\> "XXXXXXX"  
}  
}

if i use  
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/nginx.conf

it is run well

but  
i use  
systemctl start logstash

[root@bogon conf.d]# systemctl status logstash  
● logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)  
Active: active (running) since 六 2017-10-14 20:12:21 CST; 1min 17s ago  
Main PID: 18345 (java)  
CGroup: /system.slice/logstash.service  
└─18345 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.enco...

10月 14 20:13:29 bogon logstash[18345]: at org.jruby.Main.main(Main.java:197)  
10月 14 20:13:29 bogon logstash[18345]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory....rolling.Rolli  
10月 14 20:13:29 bogon logstash[18345]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)  
10月 14 20:13:29 bogon logstash[18345]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)  
10月 14 20:13:29 bogon logstash[18345]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)  
10月 14 20:13:29 bogon logstash[18345]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)  
10月 14 20:13:29 bogon logstash[18345]: ... 98 more  
10月 14 20:13:29 bogon logstash[18345]: 2017-10-14 20:13:29,601 main ERROR Null object returned for RollingFile in Appenders.  
10月 14 20:13:29 bogon logstash[18345]: 2017-10-14 20:13:29,618 main ERROR Null object returned for RollingFile in Appenders.  
10月 14 20:13:29 bogon logstash[18345]: 2017-10-14 20:13:29,625 main ERROR Unable to locate appender "plain\_rolling" for logger config "root"

log4j2.properties how to change?

thanks

---

<div class="post-metadata">

**Author:** ![bo8888](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@bo8888](https://discuss.elastic.co/u/bo8888)\
**Post date:** [October 16, 2017, 2:55am UTC](https://discuss.elastic.co/t/error-null-object-returned-for-rollingfile-in-appenders/103990/2 "2017-10-16T02:55:23Z")

</div>

need help:roll\_eyes:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2017, 2:55am UTC](https://discuss.elastic.co/t/error-null-object-returned-for-rollingfile-in-appenders/103990/3 "2017-11-13T02:55:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.