ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"

[Juliette (Verlaine)]

Hi,

I need your help ! I'm working on Elasticsearch ELK since 2 weeks and I have some issues when a try to create my first pipeline. I saw many blog, article and documentation before coming here and disturb you.

Version Linux          :  **Red Hat Enterprise Linux Server release 7.3 (Maipo)**
 Architecture           :  x86_64
 Kernel                 :  3.10.0-514.el7.x86_64

So, when I try to execute :

sudo /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }' --path.settings /etc/logstash

Sometimes I have this issue :

2017-11-16 13:36:07,258 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"

Sometimes, I have nothing, just :

Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties

But in this two case, I can't send an input (which is the object of this test ...). It's already work, one time, I saw the log in Kibana.

I didn't change the default configuration for log4j2.properties :

status = error
name = LogstashPropertiesConfig

appender.rolling.type = RollingFile
appender.rolling.name = plain_rolling
appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %-.10000m%n

appender.json_rolling.type = RollingFile
appender.json_rolling.name = json_rolling
appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.json_rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
appender.json_rolling.policies.type = Policies
appender.json_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.json_rolling.policies.time.interval = 1
appender.json_rolling.policies.time.modulate = true
appender.json_rolling.layout.type = JSONLayout
appender.json_rolling.layout.compact = true
appender.json_rolling.layout.eventEol = true

rootLogger.level = ${sys:ls.log.level}
rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling 

All the stack is in 5.6.3 !

I didn't change neither the logstash.yml because I just come to reinstall it.
I don't know, if you need anything, maybe you'll miss some information.

I forgot ... I already test to create a logstash-simple.conf and execute :

$ sudo /usr/share/logstash/bin/logstash -f logstash-simple.conf --path.settings /etc/logstash
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
The stdin plugin is now waiting for input:
Hola
{
      "@version" => "1",
          "host" => "blabla",
    "@timestamp" => 2017-11-16T08:51:07.592Z,
       "message" => "Hola"
}

So obviously it's work, but i try to execute another time and same issue.

"Rhoooo, it's always the same issue, such a noobies ..."
I see you seeing my post !

Thank's a lot !

[exNewbie]

I have the same issue. I'm running Dock with Logstash version 5.6.4.

The weird thing is that it even dumps errors when I ran a very simple config

[root@55b8577b1835 logstash]# bin/logstash -e 'input { stdin { } } output { stdout {} }'
2017-11-20 05:59:38,609 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
Sending Logstash's logs to /usr/share/logstash/log which is now configured via log4j2.properties

[2017-11-20T05:59:39,831][INFO ][logstash.agent           ] Created final config by merging config string and config path {:path=>"/usr/share/logstash/config"}
[2017-11-20T05:59:39,843][ERROR][logstash.agent           ] Cannot create pipeline {:reason=>"Expected one of #, input, filter, output at line 1, column 41 (byte 41) after "}

[hobo_zo]

I have the same problem.

[Juliette (Verlaine)]

Okay,
I'm just being back at work, so I'm going to try to fix this issue, if i find something, I will telling you !
And of course, if you find something ...

But today, the issue has desappear. When I execute the command for generate pipeline, I just have that :

Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties

I can't send anything in input, so I'm really confused.

I read that you need to configurelog4j2.properties with the same logic that you configure "path.data" and "path.logs" in your elasticsearch.yml

I'm not sure to understand all the configuration in the example of this link but maybe you can :
https://www.elastic.co/guide/en/elasticsearch/reference/5.5/settings.html

Hope you success

[rclarke (Robin Clarke)]

Have a look at this related issue: https://github.com/elastic/logstash/issues/8744

[Juliette (Verlaine)]

Thank's a lot !

[hobo_zo]

Thank U!

[vigneshaj (Aj Vignesh)]

I updated the mentioned config in log4j2.properties, but I am still getting the mentioned error.