# Logstash 1.5.2-1 Service Stops after 15s

**URL:** <https://discuss.elastic.co/t/logstash-1-5-2-1-service-stops-after-15s/59713>\
**Category:** Logstash\
**Created:** [September 2, 2016, 8:53pm UTC](https://discuss.elastic.co/t/logstash-1-5-2-1-service-stops-after-15s/59713 "2016-09-02T20:53:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashraf1390](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashraf1390](https://discuss.elastic.co/u/ashraf1390)\
**Post date:** [September 2, 2016, 8:53pm UTC](https://discuss.elastic.co/t/logstash-1-5-2-1-service-stops-after-15s/59713/1 "2016-09-02T20:53:57Z")

</div>

Hey Everyone !!!

Logstash service stops after 15s, kindly help...

OS: CentOS 7

Installed rpms  
Elasticsearch 1.6.0  
Kibana 4.1.1  
Logstash 1.5.2-1  
java-1.7.0-openjdk

**[root@cenvm01 conf.d]# ls**  
01-logstash-initial.conf

**[root@cenvm01 conf.d]# vim 01-logstash-initial.conf**  
input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

## output { elasticsearch { host =\> localhost } stdout { codec =\> rubydebug } }

**systemctl status logstash.service**  
â logstash.service - LSB: Starts Logstash as a daemon.  
Loaded: loaded (/etc/rc.d/init.d/logstash)  
Active: active (exited) since Fri 2016-09-02 16:39:13 EDT; 27min ago  
Docs: man:systemd-sysv-generator(8)  
Process: 56633 ExecStop=/etc/rc.d/init.d/logstash stop (code=exited, status=0/SUCCESS)  
Process: 56641 ExecStart=/etc/rc.d/init.d/logstash start (code=exited, status=0/SUCCESS)

## Sep 02 16:39:13 cenvm01.jungle.kvm systemd[1]: Starting LSB: Starts Logstash as a daemon.... Sep 02 16:39:13 cenvm01.jungle.kvm logstash[56641]: logstash started. Sep 02 16:39:13 cenvm01.jungle.kvm systemd[1]: Started LSB: Starts Logstash as a daemon..

## **[root@cenvm01 conf.d]# more /var/log/logstash/logstash.log** {:timestamp=\>"2016-09-02T16:39:29.658000-0400", :message=\>"An unexpected error occurred!", :error=\>#\<NoMethodError: undefi ned method `close' for nil:NilClass>, :class=>"NoMethodError", :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/lo gstash-input-lumberjack-2.0.7/lib/logstash/inputs/lumberjack.rb:99:in`stop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems /logstash-core-2.4.0-java/lib/logstash/inputs/base.rb:83:in `do_stop'", "org/jruby/RubyArray.java:1613:in`each'", "/opt/l ogstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:385:in `shutdown'", "/opt/logstash/ vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:413:in`stop\_pipeline'", "/opt/logstash/vendor /bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:406:in `shutdown_pipelines'", "org/jruby/RubyHash.ja va:1342:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:406:in `shu tdown_pipelines'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:402:in`shut down'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:233:in `execute'", "/op t/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/runner.rb:94:in`run'", "org/jruby/RubyProc. java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/runner.rb:99:in`ru n'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24: in`initialize'"], :level=\>:warn}

I'm very new to ELK, Kindly help me..

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 2, 2016, 11:58pm UTC](https://discuss.elastic.co/t/logstash-1-5-2-1-service-stops-after-15s/59713/2 "2016-09-02T23:58:19Z")

</div>

> [@ashraf1390](#):
>
> I'm very new to ELK

You should start by upgrading, 1.5 is _really_ old 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/logstash-1-5-2-1-service-stops-after-15s/59713/3 "2017-07-06T04:40:08Z")

</div>