# Logstash not working! **URL:** \ **Category:** Logstash\ **Created:** [February 21, 2021, 12:29pm UTC](https://discuss.elastic.co/t/logstash-not-working/264983 "2021-02-21T12:29:19Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Mohyden](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Post date:** [February 21, 2021, 12:29pm UTC](https://discuss.elastic.co/t/logstash-not-working/264983/1 "2021-02-21T12:29:19Z")
Hello, I'm running Ubuntu 16.04. When I try to start Logstash with `systemctl start logstash`, and then `systemctl status logstash`, it shows these: logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled) Active: failed (Result: start-limit-hit) since Sun 2021-02-21 15:19:09 +03; 8min ago Process: 19820 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE) Main PID: 19820 (code=exited, status=1/FAILURE) Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Unit entered failed state. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Failed with result 'exit-code'. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Service hold-off time over, scheduling restart. Feb 21 15:19:09 lthlibprod systemd[1]: Stopped logstash. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Start request repeated too quickly. Feb 21 15:19:09 lthlibprod systemd[1]: Failed to start logstash. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Unit entered failed state. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Failed with result 'start-limit-hit'. I'm trying to solve this issue for three days. Please help. Thank you. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 21, 2021, 5:54pm UTC](https://discuss.elastic.co/t/logstash-not-working/264983/2 "2021-02-21T17:54:55Z")
What do the logstash logs show? What is your configuration? ---
**Author:** ![Mohyden](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Post date:** [February 22, 2021, 5:23am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/3 "2021-02-22T05:23:44Z")
Thank you Badger for your reply. The logs shows: [2021-02-21T14:38:35,105][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.10.0", "jruby.version"=\>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.241-b07 on 1.8.0\_241-b07 +jit [linux-x86\_64]"} [2021-02-21T14:38:36,080][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2021-02-21T14:38:37,126][INFO][org.reflections.Reflections] Reflections took 94 ms to scan 1 urls, producing 23 keys and 47 values [2021-02-21T14:38:37,619][WARN][logstash.javapipeline][main] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary [2021-02-21T14:38:37,663][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>1, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>125, "pipeline.sources"=\>["/etc/logstash/conf.d/02-beats-people\_counter-input.conf"], :thread=\>"#\"} [2021-02-21T14:38:39,014][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=\>1.34} [2021-02-21T14:38:39,024][INFO][logstash.inputs.beats][main] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5043"} [2021-02-21T14:38:39,065][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"} [2021-02-21T14:38:39,123][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [2021-02-21T14:38:39,340][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2021-02-21T14:38:39,342][INFO][org.logstash.beats.Server][main][34c9226aa720892fcffaf85222a301e5e875c08f4df5a512eda79a67b10f3218] Starting server on port: 5043 [2021-02-21T14:39:02,432][WARN][logstash.runner] SIGINT received. Shutting down. [2021-02-21T14:39:07,474][WARN][logstash.runner] Received shutdown signal, but pipeline is still waiting for in-flight events to be processed. Sending another ^C will force quit Logstash, but this may cause data loss. [2021-02-21T14:39:09,641][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=\>"main"} [2021-02-21T14:39:10,538][INFO][logstash.runner] Logstash shut down. [2021-02-21T14:57:39,702][WARN][logstash.runner] --config.debug was specified, but log.level was not set to 'debug'! No config info will be logged. [2021-02-21T14:57:39,793][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.10.0", "jruby.version"=\>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.241-b07 on 1.8.0\_241-b07 +jit [linux-x86\_64]"} [2021-02-21T14:57:39,984][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2021-02-21T14:57:40,396][INFO][org.reflections.Reflections] Reflections took 102 ms to scan 1 urls, producing 23 keys and 47 values [2021-02-21T14:57:40,767][WARN][logstash.javapipeline][main] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary [2021-02-21T14:57:40,792][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>1, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>125, "pipeline.sources"=\>["/etc/logstash/conf.d/02-beats-people\_counter-input.conf"], :thread=\>"#\"} [2021-02-21T14:57:41,670][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=\>0.88} [2021-02-21T14:57:41,681][INFO][logstash.inputs.beats][main] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5043"} [2021-02-21T14:57:41,701][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"} [2021-02-21T14:57:41,749][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [2021-02-21T14:57:41,880][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2021-02-21T14:57:41,903][INFO][org.logstash.beats.Server][main][34c9226aa720892fcffaf85222a301e5e875c08f4df5a512eda79a67b10f3218] Starting server on port: 5043 [2021-02-21T15:05:36,539][WARN][logstash.runner] SIGINT received. Shutting down. [2021-02-21T15:05:41,558][WARN][logstash.runner] Received shutdown signal, but pipeline is still waiting for in-flight events to be processed. Sending another ^C will force quit Logstash, but this may cause data loss. [2021-02-21T15:05:42,863][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=\>"main"} [2021-02-21T15:05:43,610][INFO][logstash.runner] Logstash shut down. This is my configuration: node.name: logstashProd path.data: /data/logstash pipeline.workers: 1 path.config: /etc/logstash/conf.d config.debug: true path.logs: /var/log/logstash And, here is the "path.config: /etc/logstash/conf.d": input { beats { port =\> "5043" ssl =\> false } } file { path =\> "/people-count-data.txt" codec =\> line { format =\> "%{message}"} } } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 22, 2021, 2:40pm UTC](https://discuss.elastic.co/t/logstash-not-working/264983/4 "2021-02-22T14:40:43Z")
> [@Mohyden](#): > > [2021-02-21T14:39:02,432][WARN][logstash.runner] SIGINT received. Shutting down. Something external to logstash is telling it to exit. ---
**Author:** ![Mohyden](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Post date:** [February 23, 2021, 6:11am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/5 "2021-02-23T06:11:13Z")
Is there any way to solve it out? ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [February 23, 2021, 10:28am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/6 "2021-02-23T10:28:41Z")
It happens sometimes to me when i try to restart the service or kill it using kill -9 You might want to restart the host or try to "pkill logstash" command. > [@Mohyden](#): > > [2021-02-21T15:05:36,539][WARN][logstash.runner] SIGINT received. Shutting down. > [2021-02-21T15:05:41,558][WARN][logstash.runner] Received shutdown signal, but pipeline is still waiting for in-flight events Like badger is saying something is sending SIGINT signals to logstashs service. ---
**Author:** ![Mohyden](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Post date:** [February 23, 2021, 11:00am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/7 "2021-02-23T11:00:59Z")
Thank you grumo35. I tried `pkill logstash` and it doesn't work, even I tried to use `kill -9 {process ID}` and `killall logstash` and it throws `no process found` The status still as it is: `sudo systemctl status logstash` logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled) Active: failed (Result: start-limit-hit) since Sun 2021-02-21 15:19:09 +03; 1 day 22h ago Process: 19820 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE) Main PID: 19820 (code=exited, status=1/FAILURE) ``` Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Unit entered failed state. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Failed with result 'exit-code'. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Service hold-off time over, scheduling restart. Feb 21 15:19:09 lthlibprod systemd[1]: Stopped logstash. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Start request repeated too quickly. Feb 21 15:19:09 lthlibprod systemd[1]: Failed to start logstash. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Unit entered failed state. Feb 21 15:19:09 lthlibprod systemd[1]: logstash.service: Failed with result 'start-limit-hit'. Feb 23 13:53:04 lthlibprod systemd[1]: Stopped logstash. ``` ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [March 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/8 "2021-03-01T10:30:01Z")
What distribution you use ? Do you have any cron or scripts that runs on that machine ? Please be aware that your logstash process is stopping and starting and might just be misconfigured. The command you type does in fact kill the process but it just restart by itself using systemd. What's the configuration of the service in systemd ? And please show the output or journalctl -ru logstash ---
**Author:** ![rojin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rojin/32/97697_2.png) [@rojin](https://discuss.elastic.co/u/rojin)\ **Post date:** [March 5, 2021, 5:39pm UTC](https://discuss.elastic.co/t/logstash-not-working/264983/9 "2021-03-05T17:39:29Z")
Hello, You might wanna check the logstash pipelines (input, filter, output). Also check the ports to be open for the connection 🤔 Sharing logs would be helpful. ---
**Author:** ![Mohyden](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Mohyden](https://discuss.elastic.co/u/Mohyden)\ **Post date:** [March 7, 2021, 5:17am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/10 "2021-03-07T05:17:27Z")
Thank you all for your help and support. Our central IT team solve it for us. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2021, 5:18am UTC](https://discuss.elastic.co/t/logstash-not-working/264983/11 "2021-04-04T05:18:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.