Errors when running logstash

When I run the command bin/logstash -f 01-wazuh.conf two errors pop up and one warning. Although the file is on the specified path, oh well, the most important thing is how to fix the two lower errors?

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/ Using default config which logs errors to the console
[INFO ] 2018-04-04 10:03:11.425 [main] scaffold - Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[INFO ] 2018-04-04 10:03:12.222 [main] scaffold - Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[FATAL] 2018-04-04 10:03:12.339 [main] runner - An unexpected error occurred! {:error=>#<ArgumentError: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:448:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:230:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:141:in `block in validate_all'", "org/jruby/ `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:140:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:264:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:219:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:67:in `<main>'"]}
[ERROR] 2018-04-04 10:03:12.383 [main] Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit

Here is the config logstash:

input {
  file {
    type => "rails logs"
    path => "/home/users/apps/demo/log/logstash_development.log"
    codec =>   json {
      charset => "UTF-8"

output {
  # Print each event to stdout.
  stdout {
    codec => rubydebug

  elasticsearch {
    # Setting 'embedded' will run  a real elasticsearch server inside logstash.
    # This option below saves you from having to run a separate process just
    # for ElasticSearch, so you can get started quicker!
    index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
    document_type => "wazuh"


Path "/usr/share/logstash/data" must be a writable directory. It is not writable.

Either run Logstash as a user with write access to the directory or change the data directory path using the available settings in logstash.yml or the command-line option.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.