# Failed to start logstash

**URL:** https://discuss.elastic.co/t/failed-to-start-logstash/153984
**Category:** Logstash
**Created:** [October 25, 2018, 11:12am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984 "2018-10-25T11:12:16Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![arvind.jadaun](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@arvind.jadaun](https://discuss.elastic.co/u/arvind.jadaun)
#### Post date: [October 25, 2018, 11:12am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/1 "2018-10-25T11:12:16Z")

</div>

Hi Guys,

This is first time i am starting logstash on my windows machine and below is the error msg i have. Is there anyone out there who has similar challenges like me. Seeking for your inputs. Thanks!

```
> [2018-10-25T16:21:24,549][INFO][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/data/queue"}
> [2018-10-25T16:21:24,550][INFO][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/data/dead_letter_queue"}
> [2018-10-25T16:21:24,692][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
> [2018-10-25T16:21:24,752][INFO][logstash.agent] No persistent UUID file found. Generating new UUID {:uuid=>"eb0dd7c5-c4b4-4dea-b5e3-0f1a35515f4f", :path=>"D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/data/uuid"}
> [2018-10-25T16:21:25,351][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.4.2"}
> [2018-10-25T16:21:25,491][**ERROR**][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError", :message=>"org.apache.commons.codec.binary.Hex.encodeHexString([B)Ljava/lang/String;", :backtrace=>["org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:124)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$3$0$initialize.call(AbstractPipelineExt$INVOKER$i$3$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodThree.call(JavaMethod.java:1186)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:743)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:983)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:974)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "D_3a_.LogMgmt.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_core.lib.logstash.pipeline.RUBY$method$initialize$0(D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:22)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:983)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:974)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "D_3a_.LogMgmt.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_core.lib.logstash.pipeline.RUBY$method$initialize$0(D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:90)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:298)", "org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:79)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:83)", "org.jruby.RubyClass.newInstance(RubyClass.java:1022)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)", "D_3a_.LogMgmt.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/pipeline_action/create.rb:38)", "D_3a_.LogMgmt.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$ __VARARGS__ (D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)", "D_3a_.LogMgmt.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_6_dot_4_dot_2.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/agent.rb:309)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:145)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:71)", "org.jruby.runtime.Block.call(Block.java:124)", "org.jruby.RubyProc.call(RubyProc.java:289)", "org.jruby.RubyProc.call(RubyProc.java:246)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:104)", "java.lang.Thread.run(Thread.java:745)"]}
> [2018-10-25T16:21:25,573][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::NoSuchMethodError` for `PipelineAction::Create<main>`>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:103:in `create'", "org/logstash/execution/ConvergeResultExt.java:34:in `add'", "D:/LogMgmt/logstash-6.4.2/logstash-6.4.2/logstash-6.4.2/logstash-core/lib/logstash/agent.rb:321:in `block in converge_state'"]}
> [2018-10-25T16:21:25,644][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
```

---

<div class="post-metadata">

### Author: ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [October 25, 2018, 11:16am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/2 "2018-10-25T11:16:36Z")

</div>

Can you post your logstash.yml file?

---

<div class="post-metadata">

### Author: ![arvind.jadaun](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@arvind.jadaun](https://discuss.elastic.co/u/arvind.jadaun)
#### Post date: [October 25, 2018, 11:23am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/3 "2018-10-25T11:23:21Z")

</div>

Hi There,

everything is commented out in logstash.yml  
sharing it in two parts  
Part 1

```
# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
# pipeline:
# batch:
# size: 125
# delay: 5
#
# Or as flat keys:
#
# pipeline.batch.size: 125
# pipeline.batch.delay: 5
#
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
# node.name: test
#
# If omitted the node name will default to the machine's host name
#
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#
# path.data:
#
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#
# pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
# pipeline.workers: 2
#
# How many events to retrieve from inputs before sending to filters+workers
#
# pipeline.batch.size: 125
#
# How long to wait in milliseconds while polling for the next event
# before dispatching an undersized batch to filters+outputs
#
# pipeline.batch.delay: 50
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
#
# ------------ Pipeline Configuration Settings --------------
#
# Where to fetch the pipeline configuration for the main pipeline
#
# path.config:
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
# At startup, test if the configuration is valid and exit (dry run)
#
# config.test_and_exit: false
#
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
# config.reload.automatic: false
#
# How often to check if the pipeline configuration has changed (in seconds)
#
# config.reload.interval: 3s
#
# Show fully compiled configuration as debug log message
# NOTE: --log.level must be 'debug'
#
# config.debug: false
#
# When enabled, process escaped characters such as \n and \" in strings in the
# pipeline configuration files.
#
# config.support_escapes: false
#
# ------------ Module Settings ---------------
# Define modules here. Modules definitions must be defined as an array.
# The simple way to see this is to prepend each `name` with a `-`, and keep
# all associated variables under the `name` they are associated with, and 
# above the next, like this:
#
# modules:
# - name: MODULE_NAME
# var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
# var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
#
# Module variable names must be in the format of 
#
# var.PLUGIN_TYPE.PLUGIN_NAME.KEY
#
# modules:
#
```

---

<div class="post-metadata">

### Author: ![arvind.jadaun](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@arvind.jadaun](https://discuss.elastic.co/u/arvind.jadaun)
#### Post date: [October 25, 2018, 11:23am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/4 "2018-10-25T11:23:52Z")

</div>

```
# ------------ Cloud Settings ---------------
# Define Elastic Cloud settings here.
# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy
# and it may have an label prefix e.g. staging:dXMtZ...
# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'
# cloud.id: <identifier>
#
# Format of cloud.auth is: <user>:<pass>
# This is optional
# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'
# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'
# cloud.auth: elastic:<password>
#
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
# "persisted" for disk-based acked queueing. Defaults is memory
#
# queue.type: memory
#
# If using queue.type: persisted, the directory path where the data files will be stored.
# Default is path.data/queue
#
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
# append-only data files separated into pages. Default is 64mb
#
# queue.page_capacity: 64mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
# Default is 0 (unlimited)
#
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
# If you would like more unacked events to be buffered in Logstash, you can increase the
# capacity using this setting. Please make sure your disk drive has capacity greater than
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
# whichever criteria is reached first
# Default is 1024mb or 1gb
#
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
# Default is 1000, 0 for no periodic checkpoint.
#
# queue.checkpoint.interval: 1000
#
# ------------ Dead-Letter Queue Settings --------------
# Flag to turn on dead-letter queue.
#
# dead_letter_queue.enable: false

# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
# will be dropped if they would increase the size of the dead letter queue beyond this setting.
# Default is 1024mb
# dead_letter_queue.max_bytes: 1024mb

# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
# Default is path.data/dead_letter_queue
#
# path.dead_letter_queue:
#
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
# http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
# log.level: info
# path.logs:
#
# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
#
# ------------ X-Pack Settings (not applicable for OSS build)--------------
#
# X-Pack Monitoring
# https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html
#xpack.monitoring.enabled: false
#xpack.monitoring.elasticsearch.username: logstash_system
#xpack.monitoring.elasticsearch.password: password
#xpack.monitoring.elasticsearch.url: ["https://es1:9200", "https://es2:9200"]
#xpack.monitoring.elasticsearch.ssl.ca: ["/path/to/ca.crt"]
#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file
#xpack.monitoring.elasticsearch.ssl.truststore.password: password
#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.monitoring.elasticsearch.ssl.keystore.password: password
#xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
#xpack.monitoring.elasticsearch.sniffing: false
#xpack.monitoring.collection.interval: 10s
#xpack.monitoring.collection.pipeline.details.enabled: true
#
# X-Pack Management
# https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html
#xpack.management.enabled: false
#xpack.management.pipeline.id: ["main", "apache_logs"]
#xpack.management.elasticsearch.username: logstash_admin_user
#xpack.management.elasticsearch.password: password
#xpack.management.elasticsearch.url: ["https://es1:9200", "https://es2:9200"]
#xpack.management.elasticsearch.ssl.ca: ["/path/to/ca.crt"]
#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file
#xpack.management.elasticsearch.ssl.truststore.password: password
#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.management.elasticsearch.ssl.keystore.password: password
#xpack.management.elasticsearch.ssl.verification_mode: certificate
#xpack.management.elasticsearch.sniffing: false
#xpack.management.logstash.poll_interval: 5s
```

---

<div class="post-metadata">

### Author: ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [October 25, 2018, 11:34am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/5 "2018-10-25T11:34:37Z")

</div>

Hmm strange..

Are you sure that

```auto
path.queue

```

and

```auto
path.dead_letter_queue

```

Are writable by the logstash user (or the user that execute the process)?

---

<div class="post-metadata">

### Author: ![arvind.jadaun](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@arvind.jadaun](https://discuss.elastic.co/u/arvind.jadaun)
#### Post date: [October 25, 2018, 11:45am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/6 "2018-10-25T11:45:56Z")

</div>

Yes, Its writable  
strange thing is, the same configuration works on my co-worker's machine.  
We are running this installation for the first time.

---

<div class="post-metadata">

### Author: ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [October 26, 2018, 4:40am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/7 "2018-10-26T04:40:45Z")

</div>

> [@arvind.jadaun](#):
>
> This is first time i am starting logstash on my windows machine and below is the error msg i have. I

can you explain in brief how are you starting the logstash

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2018, 4:43am UTC](https://discuss.elastic.co/t/failed-to-start-logstash/153984/8 "2018-11-23T04:43:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
