After a few days I upgrade the Logstash from 7.4 to Logstash 7.10.1, the Logstash kill itself and restart.
I only can found the log in journalctl -u logstash.service
Feb 16 03:44:23 xxx systemd[1]: logstash.service: main process exited, code=killed, status=9/KILL
Feb 16 03:44:23 xxx systemd[1]: Unit logstash.service entered failed state.
Feb 16 03:44:23 xxx systemd[1]: logstash.service failed.
Feb 16 03:44:23 xxx systemd[1]: logstash.service holdoff time over, scheduling restart.
Feb 16 03:44:23 xxx systemd[1]: Stopped logstash.
Feb 16 03:44:23 xxx systemd[1]: Started logstash.
Feb 16 03:44:23 xxx logstash[28277]: Using bundled JDK: /usr/share/logstash/jdk
Feb 16 03:44:23 xxx logstash[28277]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Feb 16 03:44:36 xxx logstash[28277]: WARNING: An illegal reflective access operation has occurred
Feb 16 03:44:36 xxx logstash[28277]: WARNING: Illegal reflective access by org.jruby.ext.openssl.SecurityHelper (file:/tmp/jruby-28277/jruby1243451665352322095jopenssl.jar) to field java.security.MessageDigest.provider
Feb 16 03:44:36 xxx logstash[28277]: WARNING: Please consider reporting this to the maintainers of org.jruby.ext.openssl.SecurityHelper
Feb 16 03:44:36 xxx logstash[28277]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Feb 16 03:44:36 xxx logstash[28277]: WARNING: All illegal access operations will be denied in a future release
Feb 16 03:44:37 xxx logstash[28277]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
Feb 16 03:44:38 xxx logstash[28277]: [2021-02-16T03:44:38,216][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.10.1", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 11.0.8+10 on 11.0.8+10 +indy +jit [linux-x86_64]"}
Feb 16 03:44:39 xxx logstash[28277]: [2021-02-16T03:44:39,921][INFO ][logstash.monitoring.internalpipelinesource] Monitoring License OK
Feb 16 03:44:39 xxx logstash[28277]: [2021-02-16T03:44:39,924][INFO ][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline.
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,185][INFO ][org.reflections.Reflections] Reflections took 44 ms to scan 1 urls, producing 23 keys and 47 values
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,374][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://es_host_port/]}}
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,416][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Restored connection to ES instance {:url=>"http://es_host_port/"}
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,424][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] ES Output version determined {:es_version=>7}
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,426][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,473][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearchMonitoring", :hosts=>["http://es_host_port"]}
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,482][WARN ][logstash.javapipeline ][.monitoring-logstash] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary
Feb 16 03:44:41 xxx logstash[28277]: [2021-02-16T03:44:41,533][INFO ][logstash.javapipeline ][.monitoring-logstash] Starting pipeline {:pipeline_id=>".monitoring-logstash", "pipeline.workers"=>1, "pipeline.batch.size"=>2, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>2, "pipeline.sources"=>["monitoring pipeline"], :thread=>"#<Thread:0x2a876551@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:54 run>"}
Feb 16 03:44:42 xxx logstash[28277]: [2021-02-16T03:44:42,244][INFO ][logstash.javapipeline ][.monitoring-logstash] Pipeline Java execution initialization time {"seconds"=>0.71}
Feb 16 03:44:42 xxx logstash[28277]: [2021-02-16T03:44:42,279][INFO ][logstash.javapipeline ][.monitoring-logstash] Pipeline started {"pipeline.id"=>".monitoring-logstash"}
Feb 16 03:44:44 xxx logstash[28277]: [2021-02-16T03:44:44,348][INFO ][com.microsoft.azure.kusto.ingest.IngestClientImpl][main] Creating a new IngestClient
Any ideas guys? Or where we can found the error log for Logstash
Cheers,
Ling