# Logstash restarting every 20-30 seconds

**URL:** <https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940>\
**Category:** Logstash\
**Created:** [July 6, 2018, 2:52pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940 "2018-07-06T14:52:01Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 6, 2018, 2:52pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/1 "2018-07-06T14:52:02Z")

</div>

Log file has the following error  
[2018-07-06T07:50:00,389][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

logstash-simple.conf has following code

input { stdin {} }  
output {  
elasticsearch { hosts =\> ["ipadd of ES :9200"] }  
stdout { codec =\> rubydebug }  
}  
Any kind of suggestion is much appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 2:55pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/2 "2018-07-06T14:55:13Z")

</div>

What comes _before_ that in the log?

---

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 6, 2018, 2:55pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/3 "2018-07-06T14:55:57Z")

</div>

[2018-07-06T07:54:40,440][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit  
[2018-07-06T07:55:09,375][INFO][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline\_id=\>["main"], :poll\_interval=\>"30000000000ns"}  
[2018-07-06T07:55:09,445][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: You must set the password using the "xpack.management.elasticsearch.password" in logstash.yml\>, :backtrace=\>["/usr/share/logstash/x-pack/lib/config\_management/elasticsearch\_source.rb:40:in `initialize'", "/usr/share/logstash/x-pack/lib/config_management/hooks.rb:42:in`after\_bootstrap\_checks'", "/usr/share/logstash/logstash-core/lib/logstash/event\_dispatcher.rb:34:in `block in fire'", "/usr/share/logstash/logstash-core/lib/logstash/event_dispatcher.rb:32:in`fire'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:294:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in`run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:238:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in`run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in `<main>'"]} [2018-07-06T07:55:09,465][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit [2018-07-06T07:55:36,740][INFO][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline_id=>["main"], :poll_interval=>"30000000000ns"} [2018-07-06T07:55:36,794][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<ArgumentError: You must set the password using the "xpack.management.elasticsearch.password" in logstash.yml>, :backtrace=>["/usr/share/logstash/x-pack/lib/config_management/elasticsearch_source.rb:40:in`initialize'", "/usr/share/logstash/x-pack/lib/config\_management/hooks.rb:42:in `after_bootstrap_checks'", "/usr/share/logstash/logstash-core/lib/logstash/event_dispatcher.rb:34:in`block in fire'", "/usr/share/logstash/logstash-core/lib/logstash/event\_dispatcher.rb:32:in `fire'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:294:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:238:in`run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in`'"]}  
[2018-07-06T07:55:36,811][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 7:03pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/4 "2018-07-06T19:03:15Z")

</div>

> ArgumentError: You must set the password using the "xpack.management.elasticsearch.password" in logstash.yml

So... set a password or disable the X-Pack features?

---

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 6, 2018, 7:28pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/5 "2018-07-06T19:28:37Z")

</div>

After disabled the X-pack, i have the same issue, logstash service is restarting every time,

However below are new logs

[2018-07-06T12:27:13,507][ERROR][logstash.agent] An exception happened when converging configuration {:exception=\>RuntimeError, :message=\>"Could not fetch the configuration, message: Permission denied - /etc/logstash/conf.d/logstash-simple.conf", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/agent.rb:145:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:89:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:363:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}  
[2018-07-06T12:27:13,877][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 7:37pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/6 "2018-07-06T19:37:28Z")

</div>

> Could not fetch the configuration, message: Permission denied - /etc/logstash/conf.d/logstash-simple.conf

This error message is pretty clear, no?

---

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 6, 2018, 8:00pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/7 "2018-07-06T20:00:30Z")

</div>

Thanks,

I changed the permission in the file, and getting the below logs

[2018-07-06T13:44:40,300][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.  
[2018-07-06T13:44:40,694][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
Still logstash is reloading.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 8:53pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/8 "2018-07-06T20:53:22Z")

</div>

I assume logstash-simple.conf isn't empty? If you increase Logstash's log level it might give additional clues.

---

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 9, 2018, 5:14pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/9 "2018-07-09T17:14:34Z")

</div>

Yes logstash-simple.conf has the following configuration.  
input { stdin {} }  
output {  
elasticsearch { hosts =\> ["ES server:9200"] }  
stdout { codec =\> rubydebug }  
}

i have a issue of displaying logs now, its been stopped on Friday and i didn't see any other logs after that. Any suggestion is much appriciated.

---

<div class="post-metadata">

**Author:** ![pavan2](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@pavan2](https://discuss.elastic.co/u/pavan2)\
**Post date:** [July 11, 2018, 3:16am UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/10 "2018-07-11T03:16:31Z")

</div>

@magnusbaeck , Thank you so much for your time to help me with this issue.  
Issue has been resolved after the change in the syslogs & permissions settings.

---

<div class="post-metadata">

**Author:** ![anon98066099](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@anon98066099](https://discuss.elastic.co/u/anon98066099)\
**Post date:** [July 12, 2018, 3:30pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/11 "2018-07-12T15:30:10Z")

</div>

Hi.. I am installing Logstash.. I am getting the below error :

C:\Users\IYE8288\Downloads\logstash-6.3.1\logstash-6.3.1\bin\>logstash -f LogstashPipeLine.conf --config.test\_and\_exit  
Sending Logstash's logs to C:/Users/IYE8288/Downloads/logstash-6.3.1/logstash-6.3.1/logs which is now configured via log4j2.properties  
[2018-07-12T10:23:05,730][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2018-07-12T10:23:05,906][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after  
[2018-07-12T10:23:05,915][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

**My logstash service runs fine .But logs do not display in the output location.**

Can you please help me out on this..

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2018, 5:41pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/12 "2018-07-12T17:41:03Z")

</div>

@anon98066099, please start your own thread for your unrelated problem.

But before you do, google the error message ("The given configuration..."). This exact error has come up more than once before.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2018, 5:41pm UTC](https://discuss.elastic.co/t/logstash-restarting-every-20-30-seconds/138940/13 "2018-08-09T17:41:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.