Logstash could not be started because there is already another instance

muralasandeep · March 7, 2019, 12:52pm

Hi every one ,

This is Sandeep,

i am new at Logstash and i got one error when i run the Logstash confi file that is

[2019-03-07T18:09:12,677][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2019-03-07T18:09:12,745][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

this is the way i run my logstash confi file ,
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf

and what is the meaning of instance in this particular context .
Can any one help me ,what should i do here ,
Thanks

kharvey · March 7, 2019, 6:47pm

Check the services that are running on your server:

systemctl status logstash

If you run this, and it says Active: active (running) then you already have logstash running. To temporarily stop this instance you can run:

systemctl stop logstash

If you run through multiple tests, you may have to continually stop the service.

elasticforme · March 7, 2019, 7:38pm

For testing purpose I run

/usr/share/logstash/bin/logstash -f <full_path_of_config_file>

muralasandeep · March 8, 2019, 11:15am

Hi @kharvey ,
Thank you for your reply ,
i run this
systemctl status logstash

my logstash is running active and my Results is below

logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2019-03-08 10:02:45 IST; 6h ago
Main PID: 603 (java)
Tasks: 31 (limit: 3964)
CGroup: /system.slice/logstash.service
└─603 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiat

Then what should i do ,can you explain and i am new to this logstash .

Thanks

kharvey · March 8, 2019, 5:03pm

The error that you have is:

 Logstash could not be started because there is already another instance using the configured data directory.

That is because you already have logstash running in the background as a service. We verified this using the systemctl status logstash command.
So if you want to run you command

sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf

Then you will need to stop the already running logstash service. To stop the service you would run

systemctl stop logstash

That will stop the logstash service running in the background, which will allow you to run your logstash command.

I am assuming that you are just testing using the logstash command. Whenever you are done testing, you can just do

systemctl start logstash

To start the logstash service again.

You can only have 1 logstash running at a time pointing to the same data directory (/etc/logstash)

Also, if you are just testing, I would recommend adding this to your command

--config.reload.automatic
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf --config.reload.automatic

The reload.automatic will allow you to make live changes to your logstash configuration file without having to stop and start logstash to test.

I hope this helps.

muralasandeep · March 11, 2019, 5:27am

Hi @kharvey ,

Thank you so much for your replaying ,

i did follow your command ,

when i execute this code finally

sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf --config.reload.automatic

but still i am getting this Error ,

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2019-03-11T10:47:12,373][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-03-11T10:47:12,719][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2019-03-11T10:47:12,817][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

i am using OS ubuntu 18.04
java version "1.8.0_201"
RAM 4 GB
logstash version 6.5.4,
Elasticsearch version 6.5.4

could you help me please,

Thanks
Sandeep

kharvey · March 11, 2019, 3:46pm

After you run the systemctl stop logstash, check to see if the service actually stopped by running systemctl status logstash.

My assumption is the service isn't stopping. Also you may need to use sudo with both of those commands, depending on the privilege level you run with.

Worst case, you can do a ps -ef | grep logstash to see if it is running.

muralasandeep · March 12, 2019, 4:59am

Hi @kharvey ,

Thank you so much for your valuable replaying,

After i run the systemctl stop logstash then i did check my logstash status with this command systemctl status logstash i got this results

in this result it is saying inactive (dead)

logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Tue 2019-03-12 10:11:35 IST; 4min 31s ago
Process: 2807 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=0/SUCCESS)
Main PID: 2807 (code=exited, status=0/SUCCESS)

Mar 12 09:50:08 ayusmart logstash[2807]: [2019-03-12T09:50:08,522][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_
Mar 12 09:50:09 ayusmart logstash[2807]: [2019-03-12T09:50:09,720][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pi
Mar 12 09:50:09 ayusmart logstash[2807]: [2019-03-12T09:50:09,835][INFO ][org.logstash.beats.Server] Starting server on port: 5044
Mar 12 09:50:13 ayusmart logstash[2807]: [2019-03-12T09:50:13,021][INFO ][logstash.agent ] Successfully started Logstash API endpoin
Mar 12 10:11:13 ayusmart systemd[1]: Stopping logstash...
Mar 12 10:11:19 ayusmart logstash[2807]: [2019-03-12T10:11:19,360][WARN ][logstash.runner ] SIGTERM received. Shutting down.
Mar 12 10:11:31 ayusmart logstash[2807]: [2019-03-12T10:11:31,696][WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "st
Mar 12 10:11:31 ayusmart logstash[2807]: [2019-03-12T10:11:31,975][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appe
Mar 12 10:11:32 ayusmart logstash[2807]: [2019-03-12T10:11:32,180][INFO ][logstash.pipeline ] Pipeline has terminated {:pipeline_id=>"m
Mar 12 10:11:35 ayusmart systemd[1]: Stopped logstash.

it has stopped then i run my conf. file again i am getting same Error like this ,

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2019-03-12T10:18:44,382][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-03-12T10:18:44,528][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2019-03-12T10:18:44,580][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

and i used sudo also but no use ,

what should i do in this is case ?
help me ,

Thanks
Sandeep

kharvey · March 12, 2019, 3:57pm

Alright, then do a:

ps -ef | grep logstash

To see if there is another logstash process that is running.

muralasandeep · March 13, 2019, 9:20am

Hi @kharvey,

here i have run this command ,

ps -ef | grep logstas

i got this results

logstash 600 1 4 10:51 ? 00:08:12 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/gradle-license-report-0.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/guava-22.0.jar:/usr/share/logstash/logstash-core/lib/jars/j2objc-annotations-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.1.13.0.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-1.3.9.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.commands-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.contenttype-3.4.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.expressions-3.4.300.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.filesystem-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.jobs-3.5.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.resources-3.7.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.runtime-3.7.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.app-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.common-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.preferences-3.4.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.registry-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.jdt.core-3.10.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.osgi-3.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash
root 1974 1279 0 10:58 ? 00:00:00 sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic
root 1975 1974 14 10:58 ? 00:28:28 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-
/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic
smart 3828 3233 0 14:11 pts/1 00:00:00 grep --color=auto logstash

then i run

 sudo systemctl stop logstash

after that i again i did check

ps -ef | grep logstas

then i got this reuslts

root 1974 1279 0 10:58 ? 00:00:00 sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic
root 1975 1974 14 10:58 ? 00:28:31 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format
/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic
smart 3864 3233 0 14:14 pts/1 00:00:00 grep --color=auto logstash

i think, after i run "sudo systemctl stop logstash" still one instance is running

how can i stop that instance ,
here smart is instance name, i found in kibana :
Monitoring/ Clusters / elasticsearch / Kibana / Instances

if i do turnoff and then turnon my PC at that time if i run my confi. file that is working one time if i run one more confi. file or same confi.file second time that it says "Logstash could not be started because there is already another instance using the conf.data ...... " like this.

previously i did run my confi. file so many time that time it was working but now it is not working.

Thanks
Sandeep

kharvey · March 13, 2019, 3:44pm

How are you stopping the command that you run? If you are running it once, you need to stop it before you may run it again.

You can always use kill to stop the logstash process. I would recommend a kill -15 to begin with.

system · April 10, 2019, 3:44pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Cannot start logstash in command line Logstash	2	369	July 10, 2020
Logstash Error on Pipelines settings Logstash	1	345	November 13, 2019
Logstash could not be started because there is already another instance using the configured data directory Logstash	2	585	January 16, 2020
I wanna restart logstash, but I get multiple instance error Logstash	3	401	February 23, 2020
After upgrading Logstash to 6.4.1 It could not be started there is already another instance using the configured data directory Logstash	8	988	October 29, 2018

Logstash could not be started because there is already another instance

Related topics