# Logstash always restart **URL:** \ **Category:** Logstash\ **Created:** [September 16, 2020, 3:30pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854 "2020-09-16T15:30:51Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![loxiaopohaiol](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Post date:** [September 16, 2020, 3:30pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/1 "2020-09-16T15:30:51Z")
logstash version:6.0, jdk version: 1.8.0, but no error log for the logstash service, the /var/log/message log is that: Sep 16 23:17:20 localhost.localdomain systemd[1]: Started logstash. Sep 16 23:17:30 localhost.localdomain logstash[5740]: Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties Sep 16 23:17:30 localhost.localdomain systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE Sep 16 23:17:30 localhost.localdomain systemd[1]: Unit logstash.service entered failed state. Sep 16 23:17:30 localhost.localdomain systemd[1]: logstash.service failed. Sep 16 23:17:30 localhost.localdomain systemd[1]: logstash.service holdoff time over, scheduling restart. Sep 16 23:17:30 localhost.localdomain systemd[1]: Stopped logstash. Sep 16 23:17:30 localhost.localdomain systemd[1]: Started logstash. ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [September 16, 2020, 3:34pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/2 "2020-09-16T15:34:56Z")
Please provide log sample of /var/log/logstash/logstash-plain.log ---
**Author:** ![loxiaopohaiol](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Post date:** [September 16, 2020, 3:38pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/3 "2020-09-16T15:38:35Z")
This is the log: [2020-09-16T23:37:18,317][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} [2020-09-16T23:37:18,320][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} [2020-09-16T23:37:18,340][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:443:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:225:in `validate\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:136:in `block in validate_all'", "org/jruby/RubyHash.java:1343:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:135:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:280:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:232:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in `'"]} ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [September 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/4 "2020-09-16T15:41:17Z")
> \ **Author:** ![loxiaopohaiol](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Post date:** [September 16, 2020, 3:57pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/5 "2020-09-16T15:57:22Z") I have change the owner for the every files in the /var/lib/logstash, but still have the error: [2020-09-16T23:54:14,165][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["org/jruby/ext/socket/RubyTCPServer.java:127:in `initialize'", "org/jruby/RubyIO.java:875:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/puma-2.16.0-java/lib/puma/binder.rb:234:in `add_tcp_listener'", "(eval):2:in `add\_tcp\_listener'", "/usr/share/logstash/logstash-core/lib/logstash/webserver.rb:88:in `start_webserver'", "/usr/share/logstash/logstash-core/lib/logstash/webserver.rb:44:in `block in run'", "org/jruby/RubyRange.java:485:in `each'", "org/jruby/RubyEnumerable.java:1067:in `each\_with\_index'", "/usr/share/logstash/logstash-core/lib/logstash/webserver.rb:39:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:394:in `block in start\_webserver'"]} ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [September 16, 2020, 4:13pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/6 "2020-09-16T16:13:01Z")
What's your logstash configuration ? It seems that your network address is not avaibable probably because the process is stalled or you missconfigured and IP address. Please ensure logstash is killed cleanly and restart. ---
**Author:** ![loxiaopohaiol](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Post date:** [September 16, 2020, 4:17pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/7 "2020-09-16T16:17:44Z")
My logstash config file is: input { syslog { type =\> "system-syslog" port =\> 10514 } } output { elasticsearch { hosts =\> ["192.168.56.21:9200"] index =\> "system.sys.%{+YYY.MM}" } } The 192.168.56.21 is the elasticsearch master, and I can telnet the port 9200 from logstash vm. [root@localhost conf.d]# telnet 192.168.56.21 9200 Trying 192.168.56.21... Connected to 192.168.56.21. Escape character is '^]'. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 16, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/8 "2020-09-16T16:47:49Z")
logstash is trying to start the webserver used for monitoring it. What is http.host set to in logstash.yml? That is the IP it will be failing to bind to. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 14, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854/9 "2020-10-14T16:47:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.