Error regarding log4j: well worn topic

Elastic Stack Logstash
1

I'm brand new to Logstash, I'm trying to get an Filebeats - LogStash - Elasticsearch pipeline set up using the online documentation. But I'm running into a problem where I get the following error:

[root@elastic-01 logstash]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/first-pipeline.conf --path.settings /etc/logstash
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See Apache log4j 1.2 - Frequently Asked Technical Questions for more info.

While researching, it appears this error has popped up a NUMBER of times over time regarding logstash and even elasticsearch. I've read through the following posts and bug reports:

Here are my versions:

[root@elastic-01 logstash]# /usr/share/logstash/bin/logstash-plugin list --verbose beats
logstash-input-beats (3.1.12)
[root@elastic-01 logstash]# /usr/share/logstash/bin/logstash-plugin update logstash-input-beats
Updating logstash-input-beats
which: no javac in (/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
io/console on JRuby shells out to stty for most operations
Updated logstash-input-beats 3.1.12 to 3.1.15

[root@elastic-01 logstash]# cat /etc/*release
CentOS release 6.9 (Final)

[root@elastic-01 logstash]# /usr/share/logstash/bin/logstash --version
logstash 5.4.0

I installed by downloading the .rpm (30 May 2017) and using yum -install, so it seems like I got the latest distro...?

Basically, if I set my input to stdin {} I do not get this error. But if I set it to beats { port => "5043" }, I get the error.

It seems like this is a bug that keeps returning.

Since I upgraded to the latest beats plugin (see above), any other suggestions?

Thanks

EDIT: BTW, this was in the entry in the log:

[2017-06-01T12:24:48,270][ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Beats port=>5043, id=>"ee0842e64d9951495df3258d05ddacc19bf85528-3", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_8db64ba9-ebec-4e05-809c-d3d456d37f45", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60>
Error: event executor terminated

2

Seams like the issue is around the Beats plugin.

logstash --version
logstash 5.4.1

cat /etc/logstash.conf
input {
beats {
port => 5044
}
}

output {
stdout {
codec => rubydebug
}
}

/usr/share/logstash/bin/logstash -f /etc/logstash.conf
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2017-06-14T21:16:44,787][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

A fatal error has been detected by the Java Runtime Environment:

SIGSEGV (0xb) at pc=0x000000000002d166, pid=416, tid=0x00007f3755075ae8

JRE version: OpenJDK Runtime Environment (8.0_131-b11) (build 1.8.0_131-b11)

Java VM: OpenJDK 64-Bit Server VM (25.131-b11 mixed mode linux-amd64 compressed oops)

Derivative: IcedTea 3.4.0

Distribution: Custom build (Tue May 30 16:19:39 GMT 2017)

Problematic frame:

C 0x000000000002d166

Core dump written. Default location: //core or core.416

An error report file with more information is saved as:

//hs_err_pid416.log

If you would like to submit a bug report, please include

instructions on how to reproduce the bug and visit:

http://icedtea.classpath.org/bugzilla

Segmentation fault (core dumped)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.