logstash 56599 1.2 6.1 3653792 498544 ? SNsl Mar29 85:44 /usr/bin/java -
XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -X
X:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true
-Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k
-Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspa
th/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/u
sr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib
-Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/li
b/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
elastic+ 61876 0.0 29.6 4792968 2421760 ? Ssl Mar29 7:00 /bin/java -Xms2
g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseC
MSInitiatingOccupancyOnly -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -server -Xs
s1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -Djdk.io.per
missionsUseCanonicalPath=true -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimi
zation=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabl
ed=false -Dlog4j2.disable.jmx=true -Dlog4j.skipJansi=true -XX:+HeapDumpOnOutOfMe
moryError -Des.path.home=/usr/share/elasticsearch -cp /usr/share/elasticsearch/l
ib/elasticsearch-5.2.2.jar:/usr/share/elasticsearch/lib/* org.elasticsearch.boot
strap.Elasticsearch -p /var/run/elasticsearch/elasticsearch.pid --quiet -Edefaul
t.path.logs=/var/log/elasticsearch -Edefault.path.data=/var/lib/elasticsearch -E
default.path.conf=/etc/elasticsearch
Okay, looks good so far. If you bump the log level to debug, Logstash will log all the configuration it loads. That might give clues about what's going on.
I am getting below after enabling debug.
[2017-04-03T03:04:14,939][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>[#<URI::Generic:0x2e138a51 URL://localhost:9200>]}
[2017-04-03T03:04:15,127][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
[2017-04-03T03:04:15,137][INFO ][logstash.pipeline ] Pipeline main started
[2017-04-03T03:04:15,214][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2017-04-03T05:40:18,421][WARN ][logstash.runner ] SIGTERM received. Shutting down the agent.
[2017-04-03T05:40:19,082][WARN ][logstash.agent ] stopping pipeline {:id=>"main"}
[2017-04-03T05:40:26,913][WARN ][logstash.shutdownwatcher ] {"inflight_count"=>0, "stalling_thread_info"=>{}}
[2017-04-03T05:40:26,951][ERROR][logstash.shutdownwatcher ] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2017-04-03T05:40:47,075][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<ArgumentError: Setting "" hasn't been registered>, :backtrace=>["/opt/logstash/logstash-core/lib/logstash/settings.rb:29:in get_setting'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:61:inset_value'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:80:in merge'", "org/jruby/RubyHash.java:1342:ineach'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:80:in merge'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:115:invalidate_all'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:210:in execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:183:in run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:inrun'", "/opt/logstash/lib/bootstrap/environment.rb:71:in `(root)'"]}
If those are the only logs you get you didn't enable debug logging properly. All of those logs are info, warn, error, and fatal. Otherwise look further up in the log. Unless things have changed recently it should tell you exactly what configuration it loads and hopefully also from where.
log.level:debug
I have enabled the above property in logstash.yml file. Could you please let me know is there any other place to enable debug mode.
Did you try with a space before "debug"?
log.level: debugYes. i tried
Hmm. If you despite that don't get any debug logs it might be an indication that Logstash is running with different startup options than you think, which could also explain why you're still getting an elasticsearch output even though you say you don't any such thing in your configuration. Exactly how are you starting Logstash?
service logstash start/stop/restart options
Hmm. Then I don't know what's going on here.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.