# Logstash doesn't start
**URL:** https://discuss.elastic.co/t/logstash-doesnt-start/236919
**Category:** Logstash
**Created:** [June 12, 2020, 4:05pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919 "2020-06-12T16:05:16Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 12, 2020, 4:05pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/1 "2020-06-12T16:05:16Z")
Hi,I'm debugging Logstash istance:
/usr/share/logstash/bin/logstash --config.test\_and\_exit --path.settings --config.debug -f /etc/logstash/conf.d/01-wazuh.conf ---\>
> Config Validation Result: OK. Exiting Logstash
/usr/share/logstash/bin/logstash --config.test\_and\_exit --path.settings /etc/logstash --config.debug ---\>
> [2020-06-12T17:46:57,226][DEBUG][logstash.config.pipelineconfig] -------- Logstash Config ---------
> [2020-06-12T17:46:57,230][DEBUG][logstash.config.pipelineconfig] Config from source {:source=\>LogStash::Config::Source::Local, :pipeline\_id=\>:main}
> [2020-06-12T17:46:57,238][DEBUG][logstash.config.pipelineconfig] Config string {:protocol=\>"Class", :id=\>"default input"}
> [2020-06-12T17:46:57,243][DEBUG][logstash.config.pipelineconfig]
> input { stdin { type =\> stdin } }
> [2020-06-12T17:46:57,245][DEBUG][logstash.config.pipelineconfig] Config string {:protocol=\>"Class", :id=\>"default output"}
> [2020-06-12T17:46:57,249][DEBUG][logstash.config.pipelineconfig]
> output { stdout { codec =\> rubydebug } }
> [2020-06-12T17:46:57,255][DEBUG][logstash.config.pipelineconfig] Config string {:protocol=\>"string", :id=\>"config\_string"}
> [2020-06-12T17:46:57,261][DEBUG][logstash.config.pipelineconfig]
> /etc/logstash/conf.d/01-wazuh.conf
> [2020-06-12T17:46:57,265][DEBUG][logstash.config.pipelineconfig] Merged config
> [2020-06-12T17:46:57,277][DEBUG][logstash.config.pipelineconfig]
> input { stdin { type =\> stdin } }
> output { stdout { codec =\> rubydebug } }
> /etc/logstash/conf.d/01-wazuh.conf
> [2020-06-12T17:46:58,096][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)
> [2020-06-12T17:46:58,110][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
WHY?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 12, 2020, 4:14pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/2 "2020-06-12T16:14:27Z")
> [@Uzzi](#):
>
> [2020-06-12T17:46:57,277][DEBUG][logstash.config.pipelineconfig]
> input { stdin { type =\> stdin } }
> output { stdout { codec =\> rubydebug } }
The configuration looks OK. It is complaining about the very first byte of the file, perhaps there is a BOM and you need to convert it to plain text.
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 12, 2020, 4:17pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/3 "2020-06-12T16:17:00Z")
@Badger I need to convert /etc/logstash/conf.d/01-wazuh.conf to plain text?
Thank you
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 12, 2020, 4:35pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/4 "2020-06-12T16:35:28Z")
> vim --clean -c 'se nobomb|wq' /etc/logstash/conf.d/01-wazuh.conf
Same error
Then I've redownload original /01-wazuh.conf from internet ---\> same Error
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 13, 2020, 4:17pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/5 "2020-06-13T16:17:54Z")
I'm becoming crazy! logstash -f /etc/logstash/conf.d/01-wazuh.conf---\>works fine!
in /etc/logstash/conf.d the is only 01-wazhu.conf then logstash -f /etc/logstash/pipelines.yml--\>
> [Converge PipelineAction::Create] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError"
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 14, 2020, 3:19am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/6 "2020-06-14T03:19:02Z")
> [@Uzzi](#):
>
> I'm becoming crazy! logstash -f /etc/logstash/conf.d/01-wazuh.conf---\>works fine!
> in /etc/logstash/conf.d the is only 01-wazhu.conf then logstash -f /etc/logstash/pipelines.yml--\>
pipelines.yml is not a pipeline config file, it’s a pipeline setting file. when you use -f, logstash expect a pipeline configuration file or directory containing pipeline configuration, which is the reason why the following works
logstash -f /etc/logstash/conf.d/01-wazuh.conf
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 15, 2020, 5:58am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/7 "2020-06-15T05:58:23Z")
Ok, thank you.
Next step:
/usr/share/logstash/bin/logstash --config.test\_and\_exit --path.settings /etc/logstash --config.debug
> [2020-06-15T07:50:05,897][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=\>"/etc/logstash/pipelines.yml"}
> [2020-06-15T07:50:05,980][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=\>"/etc/logstash/pipelines.yml"}
> [2020-06-15T07:50:06,090][DEBUG][logstash.config.source.local.configpathloader] Skipping the following files while reading config since they don't match the specified glob pattern {:files=\>}
> [2020-06-15T07:50:06,095][DEBUG][logstash.config.source.local.configpathloader] Reading config file {:config\_file=\>"/etc/logstash/conf.d/01-wazuh.conf"}
> [2020-06-15T07:50:06,155][DEBUG][logstash.config.pipelineconfig] -------- Logstash Config ---------
> [2020-06-15T07:50:06,161][DEBUG][logstash.config.pipelineconfig] Config from source {:source=\>LogStash::Config::Source::MultiLocal, :pipeline\_id=\>:main}
> [2020-06-15T07:50:06,167][DEBUG][logstash.config.pipelineconfig] Config string {:protocol=\>"file", :id=\>"/etc/logstash/conf.d/01-wazuh.conf"}...
> ... Using config.test\_and\_exit mode. Config Validation Result: OK. Exiting Logstash
> It reads /etc/logstash/conf.d/01-wazuh.conf
When I start
/usr/share/logstash/bin/logstash --path.settings /etc/logstash
> [2020-06-15T07:54:56,555][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=\>"/etc/logstash/pipelines.yml"}
> [2020-06-15T07:54:56,598][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.7.1"}
> [2020-06-15T07:54:56,668][DEBUG][logstash.agent] Setting up metric collection
> [2020-06-15T07:54:56,764][DEBUG][logstash.instrument.periodicpoller.os] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
> [2020-06-15T07:54:57,216][DEBUG][logstash.instrument.periodicpoller.jvm] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
> [2020-06-15T07:54:57,434][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}
> [2020-06-15T07:54:57,444][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 15, 2020, 1:23pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/8 "2020-06-15T13:23:42Z")
do you have any question?
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 15, 2020, 1:53pm UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/9 "2020-06-15T13:53:26Z")
When I've started /usr/share/logstash/bin/logstash --path.settings /etc/logstash or systemctl start logstash, It doesn't read /etc/logstash/conf.d/01-wazuh.conf as main pipeline.
in pipeline.yml:
- pipeline.id: main
path.config: "/etc/logstash/conf.d/\*.conf"
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 17, 2020, 8:17am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/10 "2020-06-17T08:17:24Z")
Why cannot read conf.d/\*conf?
> [2020-06-17T10:16:01,075][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=\>"/etc/logstash/pipelines.yml"}
> [2020-06-17T10:16:01,148][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.7.1"}
> [2020-06-17T10:16:01,266][DEBUG][logstash.agent] Setting up metric collection
> [2020-06-17T10:16:01,426][DEBUG][logstash.instrument.periodicpoller.os] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
> [2020-06-17T10:16:01,970][DEBUG][logstash.instrument.periodicpoller.jvm] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
> [2020-06-17T10:16:02,172][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}
> [2020-06-17T10:16:02,194][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}
> [2020-06-17T10:16:02,239][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
> [2020-06-17T10:16:02,264][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Starting {:polling\_interval=\>5, :polling\_timeout=\>120}
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 18, 2020, 3:35am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/11 "2020-06-18T03:35:02Z")
it's really difficult to troubleshoot a problem without a complete log messages. logstash behaves differently depends on how you start it.
> [@Uzzi](#):
>
> [2020-06-17T10:16:01,075][DEBUG][logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=\>"/etc/logstash/pipelines.yml"}
> [2020-06-17T10:16:01,148][INFO][logstash.runner] Starting Logstash
looks like it reads pipeline configuration. are you sure your pipelines.yml formatted properly? what happens after this error ? did logstash shut down?
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 18, 2020, 5:43am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/12 "2020-06-18T05:43:54Z")
Hi @ptamba, thanks
After this error logstash is runningo 99% Cpu and log show:
> [2020-06-18T07:40:36,398][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}
> [2020-06-18T07:40:36,414][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}
> [2020-06-18T07:40:41,419][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}
> [2020-06-18T07:40:41,422][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}
in loop
Do you want complete logstash-plain.log?
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 6:58am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/13 "2020-06-18T06:58:32Z")
Because this is yml, please use the proper indentation;
```auto
- pipeline.id: main
path.config: "/etc/logstash/conf.d/*.conf"
```
Regards,
Fadjar Tandabawana
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 18, 2020, 7:09am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/14 "2020-06-18T07:09:15Z")
This is mine:
> - pipeline.id: main
> path.config: "/etc/logstash/conf.d/\*.conf"
with -
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 18, 2020, 7:40am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/15 "2020-06-18T07:40:06Z")
@fadjar340 @ptamba
This is complete log:
[https://paste.debian.net/1152625/](https://paste.debian.net/1152625/)
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 7:41am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/16 "2020-06-18T07:41:59Z")
Please paste the complete logstash-plain.log from the starting point of the logstash started.
open 2 ssh shell,
1. tail -f /var/log/logstash/logstash-plain/log
2. Stop the logstash
3. Start logstash and you will see the logstash-plain.log that explain why the logstash won't start.
If possible, paste the complete log from the start until end off error message of the logstash started instance.
Regards,
Fadjar Tandabawana
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 18, 2020, 7:52am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/17 "2020-06-18T07:52:46Z")
@fadjar340 I've posted complete log in previous post
Thanks
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 8:12am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/18 "2020-06-18T08:12:52Z")
If you use pipeline.id: main, better you close all command in the pipeline.yml, back yo logstash.yml and check the default config:
```auto
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#
pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
pipeline.workers: 8
#
# How many events to retrieve from inputs before sending to filters+workers
#
pipeline.batch.size: 10000
#
# How long to wait in milliseconds while polling for the next event
# before dispatching an undersized batch to filters+outputs
#
pipeline.batch.delay: 25
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
```
In my configuration, I use pipeline.yml only if I have several folder and using pipeline name instead of "main".
And it works flawlessly.
Regards,
Fadjar Tandabawana
---
### Author:  [@Uzzi](https://discuss.elastic.co/u/Uzzi)
#### Post date: [June 18, 2020, 8:25am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/19 "2020-06-18T08:25:57Z")
@fadjar340
logstash.yml: [https://paste.debian.net/1152630/](https://paste.debian.net/1152630/)
pipeline.yml: [https://paste.debian.net/1152631/](https://paste.debian.net/1152631/)
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 8:29am UTC](https://discuss.elastic.co/t/logstash-doesnt-start/236919/20 "2020-06-18T08:29:19Z")
Because the pipeline.id: main is in the logstash.yml,
please close the pipeline.yml
```auto
#- pipeline.id: main
# path.config: "/etc/logstash/conf.d/*.conf"
```
Then try to restart logstash
[Next page](https://discuss.elastic.co/t/logstash-doesnt-start/236919.md?page=2)