# Logstash keeps restarting itself

**URL:** <https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [October 7, 2021, 11:51am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124 "2021-10-07T11:51:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![grigala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grigala/32/95550_2.png) [@grigala](https://discuss.elastic.co/u/grigala)\
**Post date:** [October 7, 2021, 11:51am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124/1 "2021-10-07T11:51:26Z")

</div>

Hello everyone,

For some reason my Logstash container keeps restarting itself and every time producing the output below:

```auto
Using bundled JDK: /usr/share/logstash/jdk
warning: no jvm.options file found
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/bundler-1.17.3/lib/bundler/rubygems_integration.rb:200: warning: constant Gem::ConfigMap is deprecated
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO] 2021-10-07 11:41:51.249 [main] runner - Starting Logstash {"logstash.version"=>"7.14.0", "jruby.version"=>"jruby 9.2.19.0 (2.5.8) 2021-06-15 55810c552b OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +jit [linux-x86_64]"}
[INFO] 2021-10-07 11:41:51.266 [main] writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[INFO] 2021-10-07 11:41:51.268 [main] writabledirectory - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[WARN] 2021-10-07 11:41:51.783 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2021-10-07 11:41:51.797 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=>"5d46e07a-50f8-41ea-bf8c-a961b1910c49", :path=>"/usr/share/logstash/data/uuid"}

[ERROR] 2021-10-07 11:41:52.784 [Converge PipelineAction::Create<main>] 
agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main,
:exception=>"LogStash::ConfigurationError", 
:message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 3, column 10
(byte 27) after input {\n imap {\n host ", 
:backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", 
"org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}

[INFO] 2021-10-07 11:41:52.802 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO] 2021-10-07 11:41:52.864 [LogStash::Runner] runner - Logstash shut down.

```

Does anybody have an idea what could be a problem? It used to work before with the same configuration file I'm using right now(no changes in the file whatsoever). But now it seems to not like the **imap** definition(at least that's what log refers to):

```auto
input {
  imap {
    host = > "${IMAP_ACCOUNT_HOST}"
    user = > "${IMAP_ACCOUNT_USER}"
    password = > "${IMAP_ACCOUNT_PASSWORD}"
    port = > "${IMAP_ACCOUNT_PORT}"
  }
}

```

I'm using Logstash v7.14.0 image.

Here's my docker-compose configuration:

```auto
    image: docker.elastic.co/logstash/logstash:7.14.0
    command: "-f '/usr/share/logstash/pipeline/logstash.conf'"
    restart: always
    env_file:
      - ./logstash/logstash-pipeline.properties
    volumes:
      - type: bind
        source: ./logstash/config
        target: /usr/share/logstash/config
        read_only: true
      - type: bind
        source: ./logstash/pipeline/
        target: /usr/share/logstash/pipeline/
        read_only: true

```

The configuration files are all located in the same directory as `docker-compose.yml` under `logstash` folder.

---

<div class="post-metadata">

**Author:** ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)\
**Post date:** [October 7, 2021, 11:58am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124/2 "2021-10-07T11:58:33Z")

</div>

> [@grigala](#):
>
> ```auto
> :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 3, column 10
> (byte 27) after input {\n imap {\n host ",
> 
> ```

=\> instead of = \>

---

<div class="post-metadata">

**Author:** ![grigala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grigala/32/95550_2.png) [@grigala](https://discuss.elastic.co/u/grigala)\
**Post date:** [October 7, 2021, 12:05pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124/3 "2021-10-07T12:05:17Z")

</div>

Ahh! Thank you, didn't even notice. Must be IDEA auto formatted it.

---

<div class="post-metadata">

**Author:** ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)\
**Post date:** [October 7, 2021, 1:59pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124/4 "2021-10-07T13:59:17Z")

</div>

You are welcomed @grigala, welcome to the community !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2021, 1:59pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124/5 "2021-11-04T13:59:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.