Logstash is getting reset after 40 sec ,low uptime

Elastic Stack Logstash
1

Hi,

I checked the logstash status, after every 40-sec logstash is getting started,
Getting error message-How to solve this?

Aug 11 09:38:38 learning-1 logstash[4057]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please confirm if the YAML structure is valid (e.g. look fo...

Log attached.

-bash-4.2$ sudo systemctl status logstash
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2021-08-11 09:38:00 UTC; 38s ago
 Main PID: 4057 (java)
    Tasks: 18
   Memory: 619.9M
   CGroup: /system.slice/logstash.service
           └─4057 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -...

Aug 11 09:38:00 learning-1 systemd[1]: Started logstash.
Aug 11 09:38:00 learning-1 logstash[4057]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be rem...e release.
Aug 11 09:38:03 learning-1 logstash[4057]: WARNING: An illegal reflective access operation has occurred
Aug 11 09:38:03 learning-1 logstash[4057]: WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-c...gnal(long)
Aug 11 09:38:03 learning-1 logstash[4057]: WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
Aug 11 09:38:03 learning-1 logstash[4057]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Aug 11 09:38:03 learning-1 logstash[4057]: WARNING: All illegal access operations will be denied in a future release
Aug 11 09:38:38 learning-1 logstash[4057]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please confirm if the YAML structure is valid (e.g. look fo...
Aug 11 09:38:38 learning-1 logstash[4057]: [ERROR] 2021-08-11 09:38:38.202 [main] Logstash - java.lang.IllegalStateException: Logstash stopped processing b...Exit) exit
Hint: Some lines were ellipsized, use -l to show in full.
-bash-4.2$ sudo systemctl status logstash
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2021-08-11 09:38:38 UTC; 1s ago
 Main PID: 4631 (java)
    Tasks: 15
   Memory: 70.7M
   CGroup: /system.slice/logstash.service
           └─4631 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -...

Aug 11 09:38:38 learning-1 systemd[1]: Started logstash.
Aug 11 09:38:38 learning-1 logstash[4631]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be rem...e release.
Hint: Some lines were ellipsized, use -l to show in full.
2

I got the culprit for restarting logstash every 40 sec.
It was due to space in the logstash.yml file.

Pic attached.

But I didn't do any changes in logstash.yml since installation.

I guess it got installed like this only format.
Post removing space all pipelines are also working fine.

Error while starting logstash.

Aug 11 09:38:38 learning-1 logstash[4057]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please confirm if the YAML structure is valid (e.g. look fo...

image

3

No, the installed copy of logstash.yml would have a # in front of that line to comment it out. To enable it you have to remove the # and the space that follows it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.