# \]\[FATAL\]\[org.logstash.Logstash \] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit

**URL:** <https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283>\
**Category:** Logstash\
**Created:** [May 20, 2022, 11:06am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283 "2022-05-20T11:06:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![MOUNA1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mouna1/32/105986_2.png) [@MOUNA1](https://discuss.elastic.co/u/MOUNA1)\
**Post date:** [May 20, 2022, 11:06am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/1 "2022-05-20T11:06:29Z")

</div>

I want to configure logstash to receive logs from pfsense but i have an error when i tested the configuration via :  
/usr/share/logstash/bin/logstash --config.test\_and\_exit --log.level=debug -f /etc/logstash/conf.d/ --path.settings /etc/logstash

---

<div class="post-metadata">

**Author:** ![MOUNA1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mouna1/32/105986_2.png) [@MOUNA1](https://discuss.elastic.co/u/MOUNA1)\
**Post date:** [May 20, 2022, 11:07am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/2 "2022-05-20T11:07:46Z")

</div>

01-inputs.conf  
input {  
tcp {  
type =\> "syslog"  
port =\> 5140  
}  
}  
#udp syslog stream via 5140  
input {  
udp {  
type =\> "syslog"  
port =\> 5140  
}  
}  
input {  
beats {  
port =\> 5044  
}  
}

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 20, 2022, 11:08am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/3 "2022-05-20T11:08:18Z")

</div>

Hi @MOUNA1 Welcome to the community,

Could you share the used pipeline config file .

---

<div class="post-metadata">

**Author:** ![MOUNA1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mouna1/32/105986_2.png) [@MOUNA1](https://discuss.elastic.co/u/MOUNA1)\
**Post date:** [May 20, 2022, 11:10am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/4 "2022-05-20T11:10:40Z")

</div>

- pipeline.id: main  
path.config: "/etc/logstash/conf.d/\*.conf"

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 20, 2022, 11:12am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/5 "2022-05-20T11:12:41Z")

</div>

Hi @MOUNA1

sorry I was not clear, please share the content of the files under the path `/etc/logstash/conf.d/`

---

<div class="post-metadata">

**Author:** ![MOUNA1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mouna1/32/105986_2.png) [@MOUNA1](https://discuss.elastic.co/u/MOUNA1)\
**Post date:** [May 20, 2022, 11:18am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/6 "2022-05-20T11:18:20Z")

</div>

```auto
01-inputs.conf

```

input {  
tcp {  
type =\> "syslog"  
port =\> 5140  
}  
}  
#udp syslog stream via 5140  
input {  
udp {  
type =\> "syslog"  
port =\> 5140  
}  
}  
input {  
beats {  
port =\> 5044  
}  
}

```auto
10-syslog.conf

```

filter {  
if [type] == "syslog" {  
if [host] =~ /10.0.0.1/ {  
mutate {  
add\_tag =\> ["pfsense", "Ready"]  
}  
}

```
if "Ready" not in [tags] {
  mutate {
    add_tag => ["syslog"]
  }
}

```

}  
}  
filter {  
if [type] == "syslog" {  
mutate {  
remove\_tag =\> "Ready"  
}  
}  
}  
filter {  
if "syslog" in [tags] {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST\>  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
locale =\> "en"  
}  
if !("\_grokparsefailure" in [tags]) {  
mutate {  
replace =\> ["@source\_host", "%{syslog\_hostname}"]  
replace =\> ["@message", "%{syslog\_message}"]  
}  
}  
}  
mutate {  
remove\_field =\> [ "syslog\_hostname", "syslog\_message", "syslog\_timestamp"\>  
}  
}  
}

```auto
11-pfsense.conf

```

filter {  
if "pfsense" in [tags] {  
grok {  
add\_tag =\> ["firewall"]  
match =\> [ "message", "\<(?.\*)\>(?(?:Jan(?:uary)?|Feb(?:ru\>  
}  
mutate {  
gsub =\> ["datetime"," "," "]  
}  
date {  
match =\> ["datetime", "MMM dd HH:mm:ss"]  
timezone =\> "%{mytz}""  
}  
mutate {  
replace =\> ["message", "%{msg}"]  
}  
mutate {  
remove\_field =\> ["msg", "datetime"]  
}  
if [prog] =~ /^dhcpd$/ {  
mutate {  
add\_tag =\> ["dhcpd"]  
}  
grok {  
patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]  
match =\> ["message", "%{DHCPD}"]  
}  
}  
if [prog] =~ /^suricata/ {  
mutate {  
add\_tag =\> ["SuricataIDPS"]  
}  
grok {  
patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]  
match =\> ["message", "%{PFSENSE\_SURICATA}"]  
}  
if ![geoip] and [ids\_src\_ip] !~ /^(10.|10.0.)/ {  
geoip {  
add\_tag =\> ["GeoIP"]  
source =\> "ids\_src\_ip"

database =\> "/etc/logstash/GeoLite2-City.mmdb"  
}  
}  
if [prog] =~ /^suricata/ {  
mutate {  
add\_tag =\> ["ET-Sig"]  
add\_field =\> ["Signature\_Info", "[http://doc.emergingthreat](http://doc.emergingthreat)\>  
}  
}  
}  
if [prog] =~ /^charon$/ {  
mutate {  
add\_tag =\> ["ipsec"]  
}  
}  
if [prog] =~ /^barnyard2/ {  
mutate {  
add\_tag =\> ["barnyard2"]  
}  
}

if [prog] =~ /^openvpn/ {  
mutate {  
add\_tag =\> ["openvpn"]  
}  
}  
if [prog] =~ /^ntpd/ {  
mutate {  
add\_tag =\> ["ntpd"]  
}  
}  
if [prog] =~ /^php-fpm/ {  
mutate {  
add\_tag =\> ["web\_portal"]  
}  
grok {  
patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]  
match =\> ["message", "%{PFSENSE\_APP}%{PFSENSE\_APP\_DATA}"]  
}  
mutate {  
lowercase =\> ['pfsense\_ACTION']  
}  
}  
if [prog] =~ /^apinger/ {  
mutate {  
add\_tag =\> ["apinger"]  
}  
}  
if [prog] =~ /^filterlog$/ {  
mutate {  
remove\_field =\> ["msg", "datetime"]  
}  
grok {  
add\_tag =\> ["firewall"]  
patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]  
match =\> [ "message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IP\_SPEC\>  
"message", "%{PFSENSE\_IPv4\_SPECIFIC\_DATA}%{PFSEN\>  
"message", "%{PFSENSE\_IPv6\_SPECIFIC\_DATA}%{PFSEN\>  
}  
mutate {  
lowercase =\> ['proto']

'  
}  
if ![geoip] and [src\_ip] !~ /^(10.|10.0.)/ {  
geoip {  
add\_tag =\> ["GeoIP"]  
source =\> "src\_ip"  
database =\> "/etc/logstash/GeoLite2-City.mmdb"  
}  
}  
}  
}

}

```auto
30-outputs.conf

```

output {  
Elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "logstash-%{+YYYY.MM.dd}" }  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2022, 11:19am UTC](https://discuss.elastic.co/t/fatal-org-logstash-logstash-logstash-stopped-processing-because-of-an-error-systemexit-exit-org-jruby-exceptions-systemexit-systemexit-exit/305283/7 "2022-06-17T11:19:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.