# Init: logstash main process ended, respawning

**URL:** <https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357>\
**Category:** Logstash\
**Created:** [March 21, 2017, 6:59am UTC](https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357 "2017-03-21T06:59:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sdubey](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@sdubey](https://discuss.elastic.co/u/sdubey)\
**Post date:** [March 21, 2017, 6:59am UTC](https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357/1 "2017-03-21T06:59:04Z")

</div>

Hi,

I am trying to setup ELK first time ever and has success in setting up Elasticsearch and Kibana but facing issue with Logstash.

My env. -  
OS - Ubuntu 14.04 on Virtualbox  
Logstash - 5.0.2 installed using .deb offline

Issue -  
I am able to start logstash service using 'sysctl start logstash' but process gets terminated very frequently. see the below log. It also says that i should pass a parameter as -f with a config file. Which one ? The default config is in /etc/logstash/logstash.yml and config is at /etc/logstash/conf.d/beats.conf.  
Configtest is OK on above config attached screen shot at end.  
This is very frusterating for me because it's first time I am trying but not able to setup since past week.  
What am I doing wrong ?

/var/log/syslog -  
Mar 21 12:16:07 logstash kernel: [2053.632085] init: logstash main process (1948) terminated with status 1  
Mar 21 12:16:07 logstash kernel: [2053.632085] init: logstash main process ended, respawning

/var/log/upstart/logstash.log  
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties  
ERROR: No configuration file was specified. Perhaps you forgot to provide the '-f yourlogstash.conf' flag?  
usage:  
bin/logstash -f CONFIG\_PATH [-t] [-r] [-w COUNT] [-l LOG]  
bin/logstash -e CONFIG\_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]  
bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]  
bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]  
bin/logstash --help

/usr/share/logstash/logs/logstash-plain.log -  
No log

/var/log/logstash -  
No log file created

Config test output -

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9ef8aa4eecbaaa5962b53c370f1f0ddeb53ec9df.png)

If i run this - "/usr/share/logstash/bin# ./logstash -f /etc/logstash/conf.d/beats.conf --debug" it works. Logs below (sorry for long output)

* * *

root@logstash:/usr/share/logstash/bin# ./logstash -f /etc/logstash/conf.d/beats.conf --debug  
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults  
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.  
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console  
12:32:21.638 [LogStash::Runner] DEBUG logstash.runner - -------- Logstash Settings (\* means modified) ---------  
12:32:21.642 [LogStash::Runner] DEBUG logstash.runner - node.name: "logstash"  
12:32:21.643 [LogStash::Runner] DEBUG logstash.runner - \*path.config: "/etc/logstash/conf.d/beats.conf"  
12:32:21.643 [LogStash::Runner] DEBUG logstash.runner - path.data: "/usr/share/lo  
12:32:25.218 [[main]-pipeline-manager] INFO logstash.inputs.beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"}  
12:32:25.325 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started  
12:32:25.359 [Api Webserver] DEBUG logstash.agent - Starting puma  
12:32:25.365 [Api Webserver] DEBUG logstash.agent - Trying to start WebServer {:port=\>9600}  
12:32:25.371 [Api Webserver] DEBUG logstash.api.service - [api-service] start  
12:32:25.511 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}

* * *

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2017, 6:59am UTC](https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357/2 "2017-04-18T06:59:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
