Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

[joel.ng]

Trying out logstash for the first time, but I'm getting this error on a very basic localhost:5044 to S3 configuration:

[2020-08-18T08:15:53,638][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.8.1", "jruby.version"=>"jruby 9.2.11.1 (2.5.7) 2020-03-25 b1f55b1a40 OpenJDK 64-Bit Server VM 11.0.8+10-post-Ubuntu-0ubuntu118.04.1 on 11.0.8+10-post-Ubuntu-0ubuntu118.04.1 +indy +jit [linux-x86_64]"}
[2020-08-18T08:15:56,147][INFO ][org.reflections.Reflections] Reflections took 51 ms to scan 1 urls, producing 21 keys and 41 values
[2020-08-18T08:16:27,428][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2020-08-18T08:16:27,802][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2020-08-18T08:16:32,740][INFO ][logstash.runner          ] Logstash shut down.

My logstash config:

# /etc/logstash/conf.d$ cat vf-settings.conf

input {
  beats {
    port => 5044
  }
}

output {
  s3 {
    region => "ap-southeast-1"
    bucket => "vf-logstash"
    size_file => 20000
  }
}

All my other configs are untouched.

Logstash worked when I tried the following command. My logs appeared in my S3 bucket.

sudo /usr/share/logstash/bin/logstash -f '/etc/logstash/conf.d/vf-settings.conf'

Any ideas why running logstash through the service + config file doesn't work?

[aaron-nimocks]

input {
  beats {
    port => 5044
  }
}

output {
  stdout { }
}

Does the above work as a service? If not then it might be permissions based. What user:group owns vf-settings.conf?

[joel.ng]

Hi, that config works. Switching back to my original config after trying that fails again.

root owns it:

-rw-r--r-- 1 root root 254 Aug 19 02:37 vf-settings.conf

[aaron-nimocks]

Can you explain what you mean when you say you run it as a service?

[joel.ng]

Just running logstash with systemctl: sudo systemctl start logstash.service, instead of running the executable in the bin folder

[joel.ng]

Decided to boot up a new EC2 to try set up everything all over again. It worked.

Not sure what might be the difference. I suspect the error might be because I installed Logstash before installing Java. I did see some strange messages when I did that.

Either way, it works now.