[LogStash::Runner] runner - Logstash shut down

[Veera_V]

Hi there,

I'm trying to connect logstash and Opensearch, but I'm getting error "Logstash::Runner] runner - Logstash shutdown.

Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults

Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console

[WARN ] 2022-09-17 05:01:11.019 [main] runner - NOTICE: Running Logstash as superuser is not recommended and won't be allowed in the future. Set 'allow_superuser' to 'false' to avoid startup errors in future releases.

[INFO ] 2022-09-17 05:01:11.043 [main] runner - Starting Logstash {"logstash.version"=>"8.4.1", "jruby.version"=>"jruby 9.3.6.0 (2.6.8) 2022-06-27 7a2cbcd376 OpenJDK 64-Bit Server VM 17.0.4+8 on 17.0.4+8 +indy +jit [x86_64-linux]"}

[INFO ] 2022-09-17 05:01:11.047 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]

[WARN ] 2022-09-17 05:01:11.610 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified

[INFO ] 2022-09-17 05:01:12.946 [Agent thread] configpathloader - No config files found in path {:path=>"/usr/share/logstash/logstash.conf"}

[ERROR] 2022-09-17 05:01:12.964 [Agent thread] sourceloader - No configuration found in the configured sources.

[INFO ] 2022-09-17 05:01:13.263 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}

[INFO ] 2022-09-17 05:01:13.367 [LogStash::Runner] runner - Logstash shut down.

Here is my conf file.

input {
stdin{}
}

output {
elasticsearch {
hosts => ["https://search-testdomain-m4tzuemizflee2uaifa.us-east-1.es.amazonaws.com:9200”]

       user => “****”
    password => “****”
      index => “test”

  
  }
  stdout { 
 }

}

[system]

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns )

[leandrojmp (Leandro Pereira)]

There are at least three isses:

The first one is that you are running logstash the root user, you should avoid running logstash as the root user, it is not recommended and if you want to run it as a service later with systemctl, you will have problems with permissions.

The second one is that Logstash cannot find your configuration:

[INFO ] 2022-09-17 05:01:12.946 [Agent thread] configpathloader - No config files found in path {:path=>"/usr/share/logstash/logstash.conf"}

How are you running it? Check your command and path.

The last issue is that you said you are using Opensearch, but your output is the elasticsearch output, if your logstash version is higher than 7.10, then you will not be able to use this output, you will need to install the opensearch output, check with the Opensearch community on how to do that.