Fresh logstash 5.2 install gives log4j warnings and no logging from plugins

Elastic Stack Logstash
1

I just downloaded the new logstash version (5.2.1), and after starting it I noticed a warning message saying that log4j needs to be initialized properly.
I also noticed that plugins like kafka, beats, etc, were not emitting any output log...

I used this very simple command to reproduce the problem on a Windows machine:
$ bin\logstash -e "input{beats{port=>5044}} output{stdout{}}"

Could not find log4j2 configuration at path /Downloads/logstash-5.2.1/config/log4j2.properties. Using default config which logs to console
log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
15:52:11.185 [[main]-pipeline-manager] INFO  logstash.inputs.beats - Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
15:52:11.285 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
15:52:11.292 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
15:52:11.764 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

In the above example, I tested this behavior with the Beats input plugin, but this is also happening on several other plugins like kafka.

Tested on logstash 5.1.2 and everything works well: no warnings and plugins write log data correctly.

EDIT: Just tested on logstash 5.2.0, and I have the same behavior observed in 5.2.1. Log4j warnings + no logging.

Am I missing something here? Or is this something that should not happen?

2

I'm experiencing exactly the same.... :unamused:

Edit: just did a "apt-get install liblog4j1.2-java" and "apt-get install liblog4j2-java", but no luck after both...

3

Apperently this has to do with the beats input. See this github issue:

Although this issue has been solved already, these are the exact same error messages I get. So I think the bug just popped up again....

Edit: when I disable all beats inputs, the error messages disappear, logstash starts correctly and events start to flow into elasticsearch again :slight_smile:

Edit 2: the issue on github has been reopened again.

Edit 3: aaaaand it's closed again. Opened this new one: https://github.com/logstash-plugins/logstash-input-beats/issues/193

4

This is also happening on the logstash-input-kafka plugins, and probably others...
I do not believe this is a plugin issue, because the same plugin versions are working OK against logstash 5.1.2...

5

Any news on this?

I was hoping to hear from the logstash team...

6

Hi,
I have the the exact same problem described here.

Any news on this issue?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.