Issue on setting up Logstash

(Ananth Antony Raj Pitchaikani) #1

I am facing issue on configuring Logstash, have set java_home with Jave 1.8.0_171 (JDK)


While running logstash -f logstash-sample.conf - throwing error as Oracle "" was unexpected at this time.


On other side used NSSM and installed Logstash as service installed successfully but on starting the logstash service its automatically paused and throw a popup error as below

Windows could not resume the logstach service on local Computer.
The service did not return an error. This could be internal windows error or an internal server error.
If the problem persists, ocntact your system administrator.

Please help me on fixing this.

(Ananth Antony Raj Pitchaikani) #2

Note that the Oracle java path (C:\ProgramData\Oracle\Java\javapath) also pointed to the JDK

(Yves) #3

SInce you are running this in cmd prompt i suppose you should use the following syntax:
logstash\bin\logstash instead of bin>logstash

also make sure to not mess up logstaCH and logstaSH.

(Ananth Antony Raj Pitchaikani) #4


It typo error using Logstash.

Sorry I am running logstash in bin folder only. still facing this issue

(Christian Dahlqvist) #5

What does your configuration look like?

(Ananth Antony Raj Pitchaikani) #6

Sample Logstash configuration for creating a simple

Beats -> Logstash -> Elasticsearch pipeline.

input { stdin { } }

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"

(Christian Dahlqvist) #7

Why are you using the stdin input plugin?

(Ananth Antony Raj Pitchaikani) #8

as new to this just starting with the sample provided, does this config file cause the issue

(Christian Dahlqvist) #9

That is primarily used for testing, and I am not if it works when running Logstash as a service. If you are starting out, have a look at this introductory blog post.

(Ananth Antony Raj Pitchaikani) #10

Hi Christian,

As specified in the blog post Practical introduction, placed test.config 6 testdata.log using nssm configured the logstash service - installed successfully but there is no output generated

Also while running logstash -f test.conf - getting same Oracle "" unexpected at this time.

Please help me to fix this issue. note that I am in initial level trying to test the log that exists in testdata.log to be display in the output file

input {
file {
path => ["C:\elk\logstash\testdata.log"]
sincedb_path => "/dev/nul"
start_position => "beginning"

filter {

output {
stdout {
path => \my_output_text_file

codec => rubydebug


"Hello Logstash!”

(Christian Dahlqvist) #11

While you are working with the configuration it is often easier to start and stop Logstash manually rather than running it as a service. This makes it easier to spot errors in the configuration, and it looks like yours is not valid.

I believe this should be removed.

(Ananth Antony Raj Pitchaikani) #12

Eventough removed output file path I am getting the Oracle ""unexpected at this time error.

(Christian Dahlqvist) #13

Please show us your config as well as the exact full error you are getting. Make sure you copy and paste and format it correctly.

I am not a Windows user, but believe you should use forward slashes in your path and replace /dev/nul with just nul.

(Ananth Antony Raj Pitchaikani) #14



Running the logstash in command prompt as
below - getting the same error

(Christian Dahlqvist) #15

Seems to be some issue with your Java installation, but I have never seen this error before.

(Ananth Antony Raj Pitchaikani) #16

yes it seems to be java issue but java - version is fine as you see above screen shot

Also I have configured Elasticsearch and Kibana in the same machine its working fine.

Tried uninstalling JDK and reinstalled no luck.

Please let me know if you have any other idea to trouble shoot this

(Christian Dahlqvist) #17

Is there not a logstash.bat file you should use to start it on Windows?

(Ananth Antony Raj Pitchaikani) #18

No its exists, if I run nssm install logstash with test.conf - installation is success but while stating the service throwing error as
Windows could not resume the logstash service on local Computer.
The service did not return an error. This could be internal windows error or an internal server error.
If the problem persists, contact your system administrator.

as in the screen shot in step-1

logstash\bin folder files has logstash.bat and logstash file

(system) #19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.