# Logstash service keeps crashing **URL:** \ **Category:** Logstash\ **Created:** [December 16, 2015, 9:33am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330 "2015-12-16T09:33:10Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [December 16, 2015, 9:33am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/1 "2015-12-16T09:33:11Z")
Hello I have som problems with logstash and it keeps crashing. Im not sure why, i thought it was a premisson problem but after chmod 777 on the files, the problem still prisets. Note that this is during installation on a Debian Linux. sudo service logstash start logstash started. @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is running @netmanager:/etc$ sudo service logstash status logstash is not running @netmanager:/etc$ sudo service logstash status logstash is not running @netmanager:/etc$ sudo service logstash status logstash is not running @netmanager:/etc$ sudo service logstash configtest Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after. There is nothing in the logs either : @netmanager:/var/log/logstash$ ls logstash.err logstash.log logstash.stdout @netmanager:/var/log/logstash$ cat logstash.err @netmanager:/var/log/logstash$ cat logstash. logstash.err logstash.log logstash.stdout @netmanager:/var/log/logstash$ cat logstash.stdout Sending logstash logs to /var/log/logstash/logstash.log. Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after You may be interested in the '--configtest' flag which you can use to validate logstash's configuration before you choose to restart a running system. srooprai@netmanager:/var/log/logstash$ cat logstash.log {:timestamp=\>"2015-12-15T17:58:24.344000+0100", :message=\>"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after "} {:timestamp=\>"2015-12-15T17:58:24.351000+0100", :message=\>"You may be interested in the '--configtest' flag which you can\nuse to validate logstash's configuration before you choose\nto restart a running system."} {:timestamp=\>"2015-12-15T17:59:13.478000+0100", :message=\>"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after "} {:timestamp=\>"2015-12-15T17:59:13.495000+0100", :message=\>"You may be interested in the '--configtest' flag which you can\nuse to validate logstash's configuration before you choose\nto restart a running system."} {:timestamp=\>"2015-12-15T18:02:15.340000+0100", :message=\>"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after "} {:timestamp=\>"2015-12-15T18:02:15.347000+0100", :message=\>"You may be interested in the '--configtest' flag which you can\nuse to validate logstash's configuration before you choose\nto restart a running system."} Here are my config files :/etc/logstash$ cd conf.d/ @netmanager:/etc/logstash/conf.d$ ls 02-filebeat-input.conf 10-syslog.conf 30-elasticsearch-output.conf @netmanager:/etc/logstash/conf.d$ cat 02-filebeat-input.conf 02-filebeat-input.conf ``` input { beats { port => 5044 type => "logs" ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` @netmanager:/etc/logstash/conf.d$ cat 10-syslog.conf filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } @netmanager:/etc/logstash/conf.d$ cat 30-elasticsearch-output.conf output { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } } What iam i missing ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2015, 9:37am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/2 "2015-12-16T09:37:12Z")
Does your 02-filebeat-input.conf actually begin with "02-filebeat-input.conf" as indicated above? If not, what if you follow Logstash's suggestion and run `.../logstash --configtest -f filename.conf` on each file in the conf.d directory? That should at least indicate which file Logstash doesn't like. ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [December 16, 2015, 9:43am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/3 "2015-12-16T09:43:59Z")
> [@magnusbaeck](#): > > .../logstash --configtest -f filename.conf Hello The file name is "02-filebeat-input.conf". But im actully having trouble running the command that you sugested. .../logstash --configtest -f filename.conf, i have tried .../logstash --configtest -f 02-filebeat-input.conf. Even as sudo. Iam i doing this wrong ? Should i be in a spefic dir ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2015, 9:46am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/4 "2015-12-16T09:46:25Z")
> The file name is "02-filebeat-input.conf". Yes. But this is what you pasted in your previous post: ```auto $ cat 02-filebeat-input.conf 02-filebeat-input.conf input { beats { port => 5044 type => "logs" ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` So, does the file _actually_ begin with "02-filebeat-input.conf"? > i have tried .../logstash --configtest -f 02-filebeat-input.conf. Replace "..." with the path to your Logstash binary. ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [December 16, 2015, 9:50am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/5 "2015-12-16T09:50:11Z")
Hello Sorry the file name is 02-filebeat-input.conf /etc/logstash/conf.d$ ls 02-filebeat-input.conf ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [December 16, 2015, 9:54am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/6 "2015-12-16T09:54:57Z")
@netmanager:/opt/logstash/bin$ /opt/logstash/bin/logstash --configtest -f 02-filebeat-input.conf.d Error: No config files found: /opt/logstash/bin/02-filebeat-input.conf.d Can you make sure this path is a logstash config file? @netmanager:/opt/logstash/bin$ /opt/logstash/bin/logstash --configtest -f 10-syslog.conf Error: No config files found: /opt/logstash/bin/10-syslog.conf Can you make sure this path is a logstash config file? @netmanager:/opt/logstash/bin$ /opt/logstash/bin/logstash --configtest -f 30-elasticsearch-output.conf Error: No config files found: /opt/logstash/bin/30-elasticsearch-output.conf Can you make sure this path is a logstash config file? It says the same thing for all 3 files.... this is not good is it. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2015, 10:03am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/7 "2015-12-16T10:03:11Z")
Just use the absolute path to the files! ``` /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/02-filebeat-input.conf ``` ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [December 16, 2015, 11:25am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/8 "2015-12-16T11:25:44Z")
> [@magnusbaeck](#): > > /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/02-filebeat-input.conf IT works now 🙂 $ /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/02-filebeat-input.conf Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after @netmanager:~$ /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/10-syslog.conf Configuration OK @netmanager:~$ /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/30-elasticsearch-output.conf Configuration OK @netmanager:~$ sudo nano /etc/logstash/conf.d/02-filebeat-input.conf [sudo] password for : @netmanager:~$ /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/02-filebeat-input.conf Configuration OK @netmanager:~$ sudo service logstash configtest Configuration OK There was a problem with the 02-filebeat-input.conf file. Not sure what but i repasted the config and saved again. And it apears to be working again. Thanks for all your help ! Perhaps i should stop using nano as a text editor and learn VIM ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-service-keeps-crashing/37330/9 "2017-07-06T05:18:13Z")