I have tried to run logstash using the following command on Centos:
sudo -u logstash /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/indexing.conf --path.settings /etc/logstash
After running the above command i got the following error:
2019-06-12 12:04:40,936 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:04:40,937 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:04:40,937 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
2019-06-12 12:04:40,938 main ERROR Unable to locate appender "plain_rolling_slowlog" for logger config "slowlog"
[2019-06-12T12:04:41,385][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
ERROR: Settings 'path.config' (-f) or 'config.string' (-e) can't be used in conjunction with (--modules) or the "modules:" block in the logstash.yml file.
usage:
bin/logstash -f CONFIG_PATH [-t] [-r] [*] [-w COUNT] [-l LOG]
bin/logstash --modules MODULE_NAME [-M "MODULE_NAME.var.PLUGIN_TYPE.PLUGIN_NAME.VARIABLE_NAME=VALUE"] [-t] [-w COUNT] [-l LOG]
bin/logstash -e CONFIG_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]
bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]
bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]
bin/logstash --help
[2019-06-12T12:04:41,412][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
the only part i have changed in /etc/logstash/logstash.yml file is:
------------ Module Settings ---------------
modules:
- name: netflow
var.input.udp.port: 5044
And if i comment the whole Module settings and run the first specified sudo command, then i get the following:
2019-06-12 12:28:11,227 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:28:11,228 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:28:11,228 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
2019-06-12 12:28:11,229 main ERROR Unable to locate appender "plain_rolling_slowlog" for logger config "slowlog"
[2019-06-12T12:28:11,685][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-06-12T12:28:12,229][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2019-06-12T12:28:16,196][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2019-06-12T12:28:36,670][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x68354a8a sleep>"}
[2019-06-12T12:28:36,732][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
[2019-06-12T12:28:36,965][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9601}
At this point it just stops there and also doesn't take any inputs.
Please let me know how to resolve this issue. I am beginner in ELK stack.
Thank you.