LogStash Docker just stops after start

Elastic Stack Logstash
1

HI

Here is a simple Docker file and configuration file for Elastic Search and Log stash. The plugin wont start

version: '3.2'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.4.0
    container_name: elasticsearch
    environment:
      - node.name=elasticsearch
      - cluster.initial_master_nodes=elasticsearch
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
    ulimits:
        memlock:
          soft: -1
          hard: -1
    volumes:
      - esdata01:/Users/Assets/ELK/data
    ports:
    - 9200:9200
    - 9300:9300
    networks:
      - esnet
  logstash:
      image: docker.elastic.co/logstash/logstash:7.4.0
      container_name: logstash
      environment:
        - xpack.monitoring.enabled=false
      links:
       - elasticsearch
      volumes:
        - /Users/Assets/ELK/pipeline/:/usr/share/logstash/pipeline/
      depends_on: 
        - elasticsearch
      networks:
          - esnet 
volumes:
  esdata01:
    driver: local

networks:
  esnet

And the configuration file is as below

input { stdin { } }
output {
  elasticsearch { hosts => ["elasticsearch:9200"] }
  stdout { codec => rubydebug }
}

And the container just exits on start. No error message and i am pretty new to the stack so any help is appreciated.

logstash         | [2019-11-13T22:39:50,107][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
elasticsearch    | {"type": "server", "timestamp": "2019-11-13T22:39:50,113Z", "level": "INFO", "component": "o.e.c.m.MetaDataIndexTemplateService", "cluster.name": "docker-cluster", "node.name": "elasticsearch", "message": "adding template [logstash] for index patterns [logstash-*]", "cluster.uuid": "85h4uyuJQPKbTqOoflh_WA", "node.id": "qt3cb4TBR9yHUsBk3tQ8cg"  }
logstash         | [2019-11-13T22:39:50,198][INFO ][logstash.outputs.elasticsearch] Creating rollover alias <logstash-{now/d}-000001>
elasticsearch    | {"type": "server", "timestamp": "2019-11-13T22:39:50,251Z", "level": "INFO", "component": "o.e.c.m.MetaDataCreateIndexService", "cluster.name": "docker-cluster", "node.name": "elasticsearch", "message": "[logstash-2019.11.13-000001] creating index, cause [api], templates [logstash], shards [1]/[1], mappings [_doc]", "cluster.uuid": "85h4uyuJQPKbTqOoflh_WA", "node.id": "qt3cb4TBR9yHUsBk3tQ8cg"  }
logstash         | [2019-11-13T22:39:50,612][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
logstash         | [2019-11-13T22:39:50,750][INFO ][logstash.outputs.elasticsearch] Installing ILM policy {"policy"=>{"phases"=>{"hot"=>{"actions"=>{"rollover"=>{"max_size"=>"50gb", "max_age"=>"30d"}}}}}} to _ilm/policy/logstash-policy
elasticsearch    | {"type": "server", "timestamp": "2019-11-13T22:39:50,771Z", "level": "INFO", "component": "o.e.x.i.a.TransportPutLifecycleAction", "cluster.name": "docker-cluster", "node.name": "elasticsearch", "message": "adding index lifecycle policy [logstash-policy]", "cluster.uuid": "85h4uyuJQPKbTqOoflh_WA", "node.id": "qt3cb4TBR9yHUsBk3tQ8cg"  }
logstash         | [2019-11-13T22:39:52,258][INFO ][logstash.runner          ] Logstash shut down.
2

If a stdin {} input reaches end-of-file then it will shut down logstash.

3

Thanks for the quick reply.

Excuse me on ignorance, i thought Stdin{} will keep the stream open for any inputs we are providing correct?. Default docker image for log stash waits for stdin{} for unlimited times and prints to output console as well. So what am i missing in my conf file. Can you please explain a little more?.

4

I don't know what stdin is connected to when you start logstash like that, I am just pointing out that if stdin reads EOF then it will shut down with exactly that message.

5

Yes that Makes sense however the stdin name suggests it should wait for an input. Want to know why it doesnt wait and just exits when started. Mainly if there is an issue with my conf file.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.