I cant restart and config logstash

Elastic Stack Logstash
1

my logstash doesn't send data to elasticsearch and when i try restart it i get this error:

Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (GemspecError) There was a LoadError while loading logstash-core.gemspec:
load error: psych -- java.lang.RuntimeException: BUG: we can not copy embedded jar to temp directory from
/usr/share/logstash/logstash-core/logstash-core.gemspec:1:in `block in (root)'
Does it try to require a relative path? That's been removed

and also for this command i get this error:
sudo chkconfig logstash on==>Note: Forwarding request to 'systemctl enable logstash.service'.
Failed to execute operation: No space left on device

how can i fix that?

2

Have you run out of disk space?

3

yes i did

4

That seems to be the problem. Have you freed up space?

5

yes i completely empty out my /tmp and also delete some old log file .what is problem? i mean , i know that logstash read log from /tmp but is there any way to set where logstash read file from? i think if i set this path to the path of log file ,may be the problem will solve. it is true?

6

I am not sure I understand. What does your config look like?

7

it is mongoDB config :
input {
mongodb {
uri => 'mongodb://boomrang'
placeholder_db_dir => '/db'
placeholder_db_name => 'boomrang.db'
collection => 'wages'
batch_size => 5000
}
}

filter {
mutate {
remove_field => [ "_id", "@version", "uid" , "token"]
}
}

filter {
date {
match => [ "logdate", "ISO8601" ]
}
}

output {
elasticsearch {
hosts => ["****:9200"]
index => "pelk"
id => "mongo"
}
stdout { codec => rubydebug}
}

8

I have never used the MongoDB input plugin, so can not help you there. If you however specify the id as mongo in the Elasticsearch output, all documents will be indexed with this ID, which will lead to one document getting updated repeatedly.

9

thanks for your response . some thing else, in logstash.yml has this line =>path.data: /var/lib/logstash
what exactly meaning of this line? i read the description of this line but i cannot understand it.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.