Loghstash service is not getting started going in continues restart having error: Logstash stopped processing because of an error: (NoMethodError) private method `run' called for #<LogStash::Runner:0x32a806ef>

Elastic Stack Logstash
1

loghstash service is not getting started going in continues restart.

Error:
Logstash stopped processing because of an error: (NoMethodError) private method run' called for #<LogStash::Runner:0x32a806ef> Jun 10 16:15:03 logstash: org.jruby.exceptions.NoMethodError: (NoMethodError) private method run' called for #LogStash::Runner:0x32a806ef
logstash: at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
logstash: at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]

bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 7.17.2

OS : Redhat 7.9

Verified all config and logstash.yml still issue persist.

Even tried re-installation of the logstash giving same error.

2

[root@logstash]# sudo -u logstash /usr/share/logstash/bin/logstash --path.settings="/etc/logstash"
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[FATAL] 2026-06-10 16:25:27.944 [main] Logstash - Logstash stopped processing because of an error: (NoMethodError) private method run' called for #<LogStash::Runner:0x5bf48697> org.jruby.exceptions.NoMethodError: (NoMethodError) private method run' called for #LogStash::Runner:0x5bf48697
at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]
[root@logstash]#

3

Is this when you run any .conf file or only for a particular .conf file?
Have you try to run a simple .conf file with test data?
Something like this:

input {
  generator {
       message => 'colvalue1, colvalue2, colvalue3'
       count => 1
  }
}
filter{
}
output {
    stdout { codec => rubydebug{ metadata => true}} 
}
4

Added sample.conf in conf.d and retested, behaving same.

Can we test specific conf file? share me command I don't have any of such.

We are using pipeline.yml

[root@conf.d]# sudo -u logstash /usr/share/logstash/bin/logstash --path.settings="/etc/logstash"
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[FATAL] 2026-06-10 16:46:32.522 [main] Logstash- Logstash stopped processing because of an error: (NoMethodError) private method run' called for #<LogStash::Runner:0x49c9a814> org.jruby.exceptions.NoMethodError: (NoMethodError) private method run' called for #LogStash::Runner:0x49c9a814
at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]
[root@conf.d]# cat simple.conf
input {
generator {
message => 'colvalue1, colvalue2, colvalue3'
count => 1
}
}
filter{
}
output {
stdout { codec => rubydebug{ metadata => true}}
}
[root@conf.d]# pwd
/etc/logstash/conf.d
[root@conf.d]#

5

I did changes in one of my conf as suggested,

input {
pipeline {
address => TSO_Logs
}
}

filter {
}

output {
stdout { codec => rubydebug{ metadata => true}}
}

Still facing same issue.

Means its not specific to any conf

6

sudo -u logstash /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/simple.conf

Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[FATAL] 2026-06-10 17:10:07.781 [main] Logstash - Logstash stopped processing because of an error: (NoMethodError) private method run' called for #<LogStash::Runner:0x32a806ef> org.jruby.exceptions.NoMethodError: (NoMethodError) private method run' called for #LogStash::Runner:0x32a806ef
at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]
[root@conf.d]#
[root@conf.d]# cat /etc/logstash/conf.d/simple.conf
input {
generator {
message => 'colvalue1, colvalue2, colvalue3'
count => 1
}
}
filter{
}
output {
stdout { codec => rubydebug{ metadata => true}}
}
[root@conf.d]#

7

Have you tried to reinstall LS? Just make *.conf files backup

8

Yes, I did re-installation still facing same issue.

9

More commands hit to narrow down issue.

[root@ logstash]# /usr/share/logstash/bin/logstash -e 'input { stdin {} } output { stdout {} }'

Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[FATAL] 2026-06-10 18:16:04.538 [main] Logstash - Logstash stopped processing because of an error: (NoMethodError) private method run' called for #<LogStash::Runner:0x61e04048> org.jruby.exceptions.NoMethodError: (NoMethodError) private method run' called for #LogStash::Runner:0x61e04048
at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]
[root@logstash]#

10

Did it used to run and stopped or it never ran?

Also, did it run as a service before or you run it through the command line?

11
  1. Which plugins do you use?
  2. Have you try to stop LS service, kill LS process if exists, run the tarbal version, without installation?
  3. Have you reviewed logstash.yml, pipelines.yml, startup.options, .conf?
  4. When you removed LS rpm, have you cleaned directories:
    /usr/share/logstash/
    /var/lib/logstash/
    /etc/logstash/ - make backup this directory before reinstallation
  5. Have you tried to set debug level in logstash.yml?
    log.level: fatal
    If still no trace, then enable this:
    config.debug: true
12

Issue got auto resolved in midnight, Haven't done any changes.

I had removed newly added Elastic node from Logstash configuration, that was not worked yesterday but in early morning Logstash started automatically

Just confirm me is that ok to have 5 Elastic servers in cluster?
1 logstash and 1 Kibana.

Startup logs:

Jun 11 06:52:33 hostname logstash: at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:93) ~[?:?]
Jun 11 06:52:35 hostname logstash: Using bundled JDK: /usr/share/logstash/jdk
Jun 11 06:52:37 hostname logstash: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Jun 11 06:52:52 hostname logstash: Sending Logstash logs to /apps/logstash_logs which is now configured via log4j2.properties
Jun 11 06:52:53 hostname logstash: [2026-06-11T06:52:53,019][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
Jun 11 06:52:53 hostname logstash: [2026-06-11T06:52:53,076][INFO ][logstash.runner ] Starting Logstash
{"logstash.version"=>"7.17.2", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.14.1+1 on 11.0.14.1+1 +indy +jit [linux-x86_64]"}
Jun 11 06:52:53 hostname logstash: [2026-06-11T06:52:53,077][INFO ][logstash.runner ] JVM bootstrap flag
s: [-Xms16g, -Xmx16g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.io.tmpdir=/apps/logstash_logs, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -agentpath:/dynatrace/oneagent/agent/bin/1.333.55.20260317-092136/linux-x86-64/liboneagentjava.so=loglevelcon=none,datastorage=/dynatrace/data,lo
gdir=/dynatrace/logs]

I don't understand why its going for dynatrace afent : agentpath:/dynatrace/oneagent/agent/bin/1.333.55.20260317-092136/linux-x86-64/liboneagentjava.so=loglevelcon=none,datastorage=/dynatrace/data,lo
gdir=/dynatrace/logs

13

This is unrelated to Logstash, it is a java agent attached on Logstash JVM.

Elastic does not recommend to use Java Agents on the JVM of their products because they can cause issues, this is mostly related to Elasticsearch but it probably also applies to Logstash.

14

Thanks for the confirmation. Will stop agents over Elasticsearch evironment.

Can yo confirm if it is Ok to have 5 nodes of Elasticsearch in cluster [ 1 Primary and 4 Secondary Nodes having replica count 2 ]

Or we have to keep 4 nodes [ 1 Primary and 3 Secondary Nodes having replica count 2 ]

15

Maybe this is a problem: datastorage=/dynatrace/data

@leandrojmp Is it possible to isolate JVMS between agents? Every agent to use own specified JVM, data&log&temp directory, especially ELK is the all in one package.
Any other issues perhaps?

16

Nothing more, Thank you