# Logstash 5.4 service starts but logging to /var/log/logstash fails

**URL:** <https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161>\
**Category:** Logstash\
**Created:** [May 9, 2017, 9:08pm UTC](https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161 "2017-05-09T21:08:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jgforbes](https://avatars.discourse-cdn.com/v4/letter/j/9de0a6/32.png) [@jgforbes](https://discuss.elastic.co/u/jgforbes)\
**Post date:** [May 9, 2017, 9:08pm UTC](https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161/1 "2017-05-09T21:08:41Z")

</div>

with these errors:  
systemctl status logstash  
● logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)  
Active: active (running) since Tue 2017-05-09 16:47:39 EDT; 12min ago  
Main PID: 26787 (java)  
Tasks: 70 (limit: 512)  
CGroup: /system.slice/logstash.service  
└─26787 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-

May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: at org.jruby.Main.main(Main.java:197)  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@4f4ba7d7  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: ... 105 more  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Null object returned for RollingFile in Appenders.  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Null object returned for RollingFile in Appenders.  
May 09 16:47:46 [jeffforbes2.nacon.com](http://jeffforbes2.nacon.com) logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Unable to locate appender "plain\_rolling" for logger config "root"

When logstash is started from the command line the logging to /var/log/logstash works correctly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 9:16pm UTC](https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161/2 "2017-06-06T21:16:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.