java.lang.IllegalStateException while running logstash

Elastic Stack Logstash
1

I have tried to run logstash using the following command on Centos:

sudo -u logstash /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/indexing.conf --path.settings /etc/logstash

After running the above command i got the following error:

2019-06-12 12:04:40,936 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:04:40,937 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:04:40,937 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
2019-06-12 12:04:40,938 main ERROR Unable to locate appender "plain_rolling_slowlog" for logger config "slowlog"
[2019-06-12T12:04:41,385][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
ERROR: Settings 'path.config' (-f) or 'config.string' (-e) can't be used in conjunction with (--modules) or the "modules:" block in the logstash.yml file.
usage:
bin/logstash -f CONFIG_PATH [-t] [-r] [*] [-w COUNT] [-l LOG]
bin/logstash --modules MODULE_NAME [-M "MODULE_NAME.var.PLUGIN_TYPE.PLUGIN_NAME.VARIABLE_NAME=VALUE"] [-t] [-w COUNT] [-l LOG]
bin/logstash -e CONFIG_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]
bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]
bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]
bin/logstash --help
[2019-06-12T12:04:41,412][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

the only part i have changed in /etc/logstash/logstash.yml file is:

------------ Module Settings ---------------

modules:
- name: netflow
var.input.udp.port: 5044

And if i comment the whole Module settings and run the first specified sudo command, then i get the following:

2019-06-12 12:28:11,227 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:28:11,228 main ERROR Null object returned for RollingFile in Appenders.
2019-06-12 12:28:11,228 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
2019-06-12 12:28:11,229 main ERROR Unable to locate appender "plain_rolling_slowlog" for logger config "slowlog"
[2019-06-12T12:28:11,685][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-06-12T12:28:12,229][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.3.1"}
[2019-06-12T12:28:16,196][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2019-06-12T12:28:36,670][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x68354a8a sleep>"}
[2019-06-12T12:28:36,732][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
[2019-06-12T12:28:36,965][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9601}

At this point it just stops there and also doesn't take any inputs.

Please let me know how to resolve this issue. I am beginner in ELK stack.
Thank you.

2

Unfortunately, the logstash modules cannot be run simultaneously in the same process with other pipelines; your solution to comment out modules was the correct path forward if you intend to run the pipelines configured in /etc/logstash/conf.d/indexing.conf.

Once you did that, Logstash started up normally. I can see that one pipeline started.

What inputs do you have defined in /etc/logstash/conf.d/indexing.conf, and how are you sending data to the Logstash node?

1 Like
3

Hello yaauie,
Thank you for explaining the error in detail, now that i have understood the error I have commented the path in /etc/logstash/conf.d/indexing.conf ,then ran the sudo command as I have specified at the beginning and logstash ran successfully .

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.