Logstash is creating a directory literally called ${sys:ls.logs}

Elastic Stack Logstash
1

When I run logstash 5.5.1 I am used to getting an error

ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.

Followed by the message

Sending Logstash's logs to /opt/applications/logstash/logs/ls-part1 which is now configured via log4j2.properties

I believe this is fixed in today's 5.6 release. There is another issue I have. If I run /usr/share/logstash/bin/logstash from the directory that I pass it as --path.settings then instead of that first error I get

ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"

and it creates this directory:

drwxr-xr-x 2 root root 4096 Sep 11 16:00 ${sys:ls.logs}/

Is this also fixed?

2

Please provide the full command you are running.

3

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.HelioWebEvents/ --path.settings=/etc/logstash --path.data=/tmp/data.HelioWeb

The non-comment lines in logstash.yml are

path.data: /opt/applications/logstash/logs/loads/data
path.config: /etc/logstash/conf.d
path.logs: /opt/applications/logstash/logs/loads

The log4j2.properties is unmodified and does reference

appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
and
rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling

Run from /etc/logstash I get the second error, from anywhere else the first.

4

The issue exists in 5.6 too.

2 Likes
5

With Logstash 5.6.2:

sudo -Hu logstash /usr/share/logstash/bin/logstash -f /etc/logstash/ -t --path.settings /etc/logstash

creates a longer stacktrace and:

2017-10-06 14:12:56,072 main ERROR Null object returned for RollingFile in Appenders.
2017-10-06 14:12:56,073 main ERROR Null object returned for RollingFile in Appenders.
2017-10-06 14:12:56,074 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties

and creates the mentioned file in /etc/logstash

6

This is actually for me
i'm on 5.6.2 version now.

7

Wanted to chime in and state that we're seeing this issue as well. Haven't been able to nail it down to the exact cause, but it's creating quite a messy file system for us.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.