# Logstash shuts down within seconds after successfully starting Logstash API endpoint
**URL:** https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733
**Category:** Elasticsearch
**Created:** [September 23, 2019, 6:07pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733 "2019-09-23T18:07:53Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [September 23, 2019, 6:07pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/1 "2019-09-23T18:07:54Z")
Hi there,
I am trying to config and run logstash for which I ran this command - sudo bin/logstash -e 'input { stdin {} } output { elasticsearch { hosts =\> [192.168.0.12:9200"] }}'
It ran and gave me this output.
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN] 2019-09-23 13:56:54.175 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2019-09-23 13:56:54.199 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"7.3.2"}
[ERROR] 2019-09-23 13:56:56.105 [Converge PipelineAction::Create] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, ,, ] at line 1, column 62 (byte 62) after output { elasticsearch { hosts =\> [192.168", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]}
[INFO] 2019-09-23 13:56:56.579 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}
[INFO] 2019-09-23 13:57:01.522 [LogStash::Runner] runner - Logstash shut down.
Before I could test the logstash service by writing Hello, this is Mehak after the message [INFO] 2019-09-23 13:56:56.579 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}, it stopped within seconds. Please guide me here as I am very new to this setup.
And I have log file created in /var/log/logstash.
Please help, thanks!
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [September 23, 2019, 6:17pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/2 "2019-09-23T18:17:31Z")
> [@Mehak\_Bhargava](#):
>
> elasticsearch { hosts =\> [192.168.0.12:9200"]
missing " before host name
elasticsearch { hosts =\> ["192.168.0.12:9200"]
---
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [September 23, 2019, 6:35pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/3 "2019-09-23T18:35:21Z")
Thanks, fixed that.
I am concerned about the correct file placements in folders.
And now I am getting this repetitive warning-
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN] 2019-09-23 14:29:08.648 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2019-09-23 14:29:08.669 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"7.3.2"}
[INFO] 2019-09-23 14:29:12.109 [Converge PipelineAction::Create] Reflections - Reflections took 215 ms to scan 1 urls, producing 19 keys and 39 values
[INFO] 2019-09-23 14:29:14.319 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://192.168.0.12:9200/](http://192.168.0.12:9200/)]}}
[WARN] 2019-09-23 14:29:24.609 [[main]-pipeline-manager] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
[INFO] 2019-09-23 14:29:24.671 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//192.168.0.12:9200](https://192.168.0.12:9200)"]}
[WARN] 2019-09-23 14:29:24.900 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster\_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[INFO] 2019-09-23 14:29:24.904 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>3, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>375, :thread=\>"#\"}
[INFO] 2019-09-23 14:29:25.177 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"}
The stdin plugin is now waiting for input:
[INFO] 2019-09-23 14:29:25.403 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
[INFO] 2019-09-23 14:29:26.347 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}
This is Logstash[WARN] 2019-09-23 14:29:39.714 [Ruby-0-Thread-4: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
on[WARN] 2019-09-23 14:29:50.735 [Ruby-0-Thread-4: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
[WARN] 2019-09-23 14:30:01.753 [Ruby-0-Thread-4: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
[WARN] 2019-09-23 14:30:12.776 [Ruby-0-Thread-4: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
This is Logstash
[WARN] 2019-09-23 14:30:23.793 [Ruby-0-Thread-4: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://192.168.0.12:9200/](http://192.168.0.12:9200/)][Manticore::ConnectTimeout] connect timed out"}
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [September 23, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/4 "2019-09-23T18:41:12Z")
> [@Mehak\_Bhargava](#):
>
> elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://192.168.0.12:9200/](http://192.168.0.12:9200/)"
is your elastic-search up and running at "[http://192.168.0.12:9200](http://192.168.0.12:9200)" ?
---
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [September 23, 2019, 7:00pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/5 "2019-09-23T19:00:45Z")
They are all running at localhost:9200 so I changed it in command as well which gave me this output-
[INFO] 2019-09-23 14:55:58.251 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
[INFO] 2019-09-23 14:55:59.055 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}
[INFO] 2019-09-23 14:55:59.219 [Ruby-0-Thread-5: :1] elasticsearch - Creating rollover alias \
[INFO] 2019-09-23 14:56:00.404 [Ruby-0-Thread-5: :1] elasticsearch - Installing ILM policy {"policy"=\>{"phases"=\>{"hot"=\>{"actions"=\>{"rollover"=\>{"max\_size"=\>"50gb", "max\_age"=\>"30d"}}}}}} to \_ilm/policy/logstash-policy
I searched the [http://localhost:9200/logstash-\*/\_search](http://localhost:9200/logstash-*/_search) on Postman and got result as below-
{
"took": 104,
"timed\_out": false,
"\_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 1,
"relation": "eq"
},
"max\_score": 1.0,
"hits": [
{
"\_index": "logstash-2019.09.23-000001",
"\_type": "\_doc",
"\_id": "1PSMX20BoEav-QC8yH-l",
"\_score": 1.0,
"\_source": {
"@version": "1",
"host": "osboxes",
"message": "This is Logstahs",
"@timestamp": "2019-09-23T19:15:24.205Z"
}
}
]
}
}
Does this mean my logstash is configured and running?
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [September 24, 2019, 1:59am UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/6 "2019-09-24T01:59:47Z")
> [@Mehak\_Bhargava](#):
>
> Does this mean my logstash is configured and running?
Yes it's running
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2019, 1:59am UTC](https://discuss.elastic.co/t/logstash-shuts-down-within-seconds-after-successfully-starting-logstash-api-endpoint/200733/7 "2019-10-22T01:59:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.