# Logstash could not be started because there is already another instance

**URL:** <https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306>\
**Category:** Logstash\
**Created:** [March 7, 2019, 12:52pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306 "2019-03-07T12:52:12Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![muralasandeep](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\
**Post date:** [March 7, 2019, 12:52pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/1 "2019-03-07T12:52:12Z")

</div>

Hi every one ,

This is Sandeep,

i am new at Logstash and i got one error when i run the Logstash confi file that is

[2019-03-07T18:09:12,677][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.  
[2019-03-07T18:09:12,745][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

this is the way i run my logstash confi file ,  
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf

and what is the meaning of instance in this particular context .  
Can any one help me ,what should i do here ,  
Thanks

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 7, 2019, 6:47pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/2 "2019-03-07T18:47:34Z")

</div>

Check the services that are running on your server:

```auto
systemctl status logstash
```

If you run this, and it says Active: active (running) then you already have logstash running. To temporarily stop this instance you can run:

```auto
systemctl stop logstash
```

If you run through multiple tests, you may have to continually stop the service.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [March 7, 2019, 7:38pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/3 "2019-03-07T19:38:27Z")

</div>

For testing purpose I run

/usr/share/logstash/bin/logstash -f \<full\_path\_of\_config\_file\>

---

<div class="post-metadata">

**Author:** ![muralasandeep](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\
**Post date:** [March 8, 2019, 11:15am UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/4 "2019-03-08T11:15:25Z")

</div>

Hi @kharvey ,  
Thank you for your reply ,  
i run this  
systemctl status logstash

my logstash is running active and my Results is below

logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)  
Active: active (running) since Fri 2019-03-08 10:02:45 IST; 6h ago  
Main PID: 603 (java)  
Tasks: 31 (limit: 3964)  
CGroup: /system.slice/logstash.service  
└─603 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiat

* * *

Then what should i do ,can you explain and i am new to this logstash .

Thanks

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 8, 2019, 5:03pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/5 "2019-03-08T17:03:18Z")

</div>

The error that you have is:

```auto
 Logstash could not be started because there is already another instance using the configured data directory.
```

That is because you already have logstash running in the background as a service. We verified this using the systemctl status logstash command.  
So if you want to run you command

```auto
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf
```

Then you will need to stop the already running logstash service. To stop the service you would run

```auto
systemctl stop logstash
```

That will stop the logstash service running in the background, which will allow you to run your logstash command.

I am assuming that you are just testing using the logstash command. Whenever you are done testing, you can just do

```auto
systemctl start logstash
```

To start the logstash service again.

You can only have 1 logstash running at a time pointing to the same data directory (/etc/logstash)

Also, if you are just testing, I would recommend adding this to your command

```auto
--config.reload.automatic
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf --config.reload.automatic
```

The reload.automatic will allow you to make live changes to your logstash configuration file without having to stop and start logstash to test.

I hope this helps.

---

<div class="post-metadata">

**Author:** ![muralasandeep](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\
**Post date:** [March 11, 2019, 5:27am UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/6 "2019-03-11T05:27:21Z")

</div>

Hi @kharvey ,

Thank you so much for your replaying ,

i did follow your command ,

when i execute this code finally

```auto
sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/syslog.conf --config.reload.automatic
```

but still i am getting this Error ,

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties  
[2019-03-11T10:47:12,373][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2019-03-11T10:47:12,719][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.  
[2019-03-11T10:47:12,817][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

i am using OS ubuntu 18.04  
java version "1.8.0\_201"  
RAM 4 GB  
logstash version 6.5.4,  
Elasticsearch version 6.5.4

could you help me please,

Thanks  
Sandeep

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 11, 2019, 3:46pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/7 "2019-03-11T15:46:46Z")

</div>

After you run the systemctl stop logstash, check to see if the service actually stopped by running systemctl status logstash.

My assumption is the service isn't stopping. Also you may need to use sudo with both of those commands, depending on the privilege level you run with.

Worst case, you can do a ps -ef | grep logstash to see if it is running.

---

<div class="post-metadata">

**Author:** ![muralasandeep](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\
**Post date:** [March 12, 2019, 4:59am UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/8 "2019-03-12T04:59:32Z")

</div>

Hi @kharvey ,

Thank you so much for your valuable replaying,

After i run the systemctl stop logstash then i did check my logstash status with this command systemctl status logstash i got this results

in this result it is saying **inactive** (dead)

logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)  
Active: inactive (dead) since Tue 2019-03-12 10:11:35 IST; 4min 31s ago  
Process: 2807 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=0/SUCCESS)  
Main PID: 2807 (code=exited, status=0/SUCCESS)

Mar 12 09:50:08 ayusmart logstash[2807]: [2019-03-12T09:50:08,522][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_  
Mar 12 09:50:09 ayusmart logstash[2807]: [2019-03-12T09:50:09,720][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pi  
Mar 12 09:50:09 ayusmart logstash[2807]: [2019-03-12T09:50:09,835][INFO][org.logstash.beats.Server] Starting server on port: 5044  
Mar 12 09:50:13 ayusmart logstash[2807]: [2019-03-12T09:50:13,021][INFO][logstash.agent] Successfully started Logstash API endpoin  
Mar 12 10:11:13 ayusmart systemd[1]: Stopping logstash...  
Mar 12 10:11:19 ayusmart logstash[2807]: [2019-03-12T10:11:19,360][WARN][logstash.runner] SIGTERM received. Shutting down.  
Mar 12 10:11:31 ayusmart logstash[2807]: [2019-03-12T10:11:31,696][WARN][org.logstash.execution.ShutdownWatcherExt] {"inflight\_count"=\>0, "st  
Mar 12 10:11:31 ayusmart logstash[2807]: [2019-03-12T10:11:31,975][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appe  
Mar 12 10:11:32 ayusmart logstash[2807]: [2019-03-12T10:11:32,180][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"m  
Mar 12 10:11:35 ayusmart systemd[1]: Stopped logstash.

it has stopped then i run my conf. file again i am getting same Error like this ,

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties  
[2019-03-12T10:18:44,382][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2019-03-12T10:18:44,528][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.  
[2019-03-12T10:18:44,580][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

and i used sudo also but no use ,

what should i do in this is case ?  
help me ,

Thanks  
Sandeep

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 12, 2019, 3:57pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/9 "2019-03-12T15:57:35Z")

</div>

Alright, then do a:

```auto
ps -ef | grep logstash
```

To see if there is another logstash process that is running.

---

<div class="post-metadata">

**Author:** ![muralasandeep](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\
**Post date:** [March 13, 2019, 9:20am UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/10 "2019-03-13T09:20:20Z")

</div>

Hi @kharvey,

here i have run this command ,

```auto
ps -ef | grep logstas
```

i got this results

logstash 600 1 4 10:51 ? 00:08:12 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error\_prone\_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/gradle-license-report-0.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/guava-22.0.jar:/usr/share/logstash/logstash-core/lib/jars/j2objc-annotations-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.9.5.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.1.13.0.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-1.3.9.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.9.1.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.commands-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.contenttype-3.4.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.expressions-3.4.300.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.filesystem-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.jobs-3.5.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.resources-3.7.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.runtime-3.7.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.app-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.common-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.preferences-3.4.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.registry-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.jdt.core-3.10.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.osgi-3.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash  
root 1974 1279 0 10:58 ? 00:00:00 sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic  
root 1975 1974 14 10:58 ? 00:28:28 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error\_prone\_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-  
/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic  
smart 3828 3233 0 14:11 pts/1 00:00:00 grep --color=auto logstash

then i run

```auto
 sudo systemctl stop logstash 
```

after that i again i did check

```auto
ps -ef | grep logstas
```

then i got this reuslts

root 1974 1279 0 10:58 ? 00:00:00 sudo bin/logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic  
root 1975 1974 14 10:58 ? 00:28:31 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /usr/share/logstash/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.11.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/usr/share/logstash/logstash-core/lib/jars/error\_prone\_annotations-2.0.18.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format  
/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash --path.settings /etc/logstash/ --path.data sensor39 -f /home/Data/logs.conf --config.reload.automatic  
smart 3864 3233 0 14:14 pts/1 00:00:00 grep --color=auto logstash

i think, after i run "sudo systemctl stop logstash" still one instance is running

how can i stop that instance ,  
here smart is instance name, i found in kibana :  
Monitoring/ Clusters / elasticsearch / Kibana / Instances

if i do turnoff and then turnon my PC at that time if i run my confi. file that is working one time if i run one more confi. file or same confi.file second time that it says "Logstash could not be started because there is already another instance using the conf.data ...... " like this.

previously i did run my confi. file so many time that time it was working but now it is not working.

Thanks  
Sandeep

---

<div class="post-metadata">

**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\
**Post date:** [March 13, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/11 "2019-03-13T15:44:09Z")

</div>

How are you stopping the command that you run? If you are running it once, you need to stop it before you may run it again.

You can always use kill to stop the logstash process. I would recommend a kill -15 to begin with.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-could-not-be-started-because-there-is-already-another-instance/171306/12 "2019-04-10T15:44:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.