Logstash 5 unexpected error occurred queue must be a writable

[namobuddhaonion (Namo Buddha)]

I installed Logstash using the following guide (I also have Elasticseach and Kibana 5) on an Ubuntu 16.0x base.

https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

Logstash appears to work from the command, but when I try to start it as a service, I get the following error.

[2016-12-13T14:13:38,292][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<ArgumentError: Path "/usr/share/logstash/data/queue" must be a writable directory. It is not writable.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:420:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:202:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:118:in `validate_all'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:117:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:205:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:178:in `run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in `(root)'"]}

Cat /var/log/syslog | grep logstash has the following, it looks like the service is trying to start over and over:

Dec 13 14:13:37 lab-elk50 logstash[22670]: Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Dec 13 14:13:38 lab-elk50 systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Dec 13 14:13:38 lab-elk50 systemd[1]: logstash.service: Unit entered failed state.
Dec 13 14:13:38 lab-elk50 systemd[1]: logstash.service: Failed with result 'exit-code'.
Dec 13 14:13:38 lab-elk50 systemd[1]: logstash.service: Service hold-off time over, scheduling restart.
Dec 13 14:13:38 lab-elk50 systemd[1]: Stopped logstash.
Dec 13 14:13:38 lab-elk50 systemd[1]: Started logstash.


 (I set it up as a service in auto start with systemd using
sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable logstash.service`Preformatted text`

[magnusbaeck (Magnus Bäck)]

Please edit your post and format your log snippet as preformatted text. When you don't do that, the really important part of the log message (the stuff that follows :errors=>#) is filtered out.

[namobuddhaonion (Namo Buddha)]

Thanks!

I changed it as requested. Any ideas why Logstash won't startup as a service, it works from the command line.

Thanks again!

[magnusbaeck (Magnus Bäck)]

I changed it as requested.

Next time, format the the log snippet as preformatted text. Not the whole post.

Well, here's your error message:

Path "/usr/share/logstash/data/queue" must be a writable directory. It is not writable.

So, make sure the directory is writable for the Logstash user.