I have the following config
input {
beats {
'port' => '5044'
}
}
output {
cloudwatch {
'region'=> 'us-west-2'
}
}
I have only one conf file in /usr/share/logstash/pipeline/
bash-4.2$ ls /usr/share/logstash/pipeline
logstash.conf
And only one Java process from ps -ef. Running this in a container
bash-4.2$ ps -ef
UID PID PPID C STIME TTY TIME CMD
logstash 1 0 0 17:33 ? 00:00:00 bash -c echo -e $CONFIG > /usr/share/logstash/pipeline/logstash.conf && /usr/local/bin/docker-entrypoint
logstash 5 1 6 17:33 ? 00:01:00 /bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headl
logstash 62 0 0 17:38 ? 00:00:00 bash
logstash 77 62 0 17:47 ? 00:00:00 ps -ef
However logstash fails and gives
[2017-12-06T07:36:46,505][ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Beats port=>9600, id=>"a585f91b9cdadf6400c91b02e2bd3177cf93afd8-1...
Error: event executor terminated