Logstash starting queries

Elastic Stack Logstash
1

Hi All,

I have been using ELastic stack for parsing syslog and store it in elasticsearch, but i have problem in starting the service the logstash,

When i start the logstash like , service logstash start , it crashes but if I use it

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --debug , it runs and it outputs the data , but if I start like this lets says my command terminal is inactive after few hours will the service stops or still it work as init.d service.

Sorry if its silly question,but I want understand it .

Thanks,
Raj

2

When i start the logstash like , service logstash start , it crashes

Have you looked in the logs for clues about why this might happen?

3

Thanks for the reply ,
Something like this

[2017-11-06T14:09:57,539][ERROR][logstash.pipeline ] Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0xecedf92 @namespaced_metric=#<LogStash::Instrument::NamespacedNullMetric:0x79a04703 @metric=#<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x50474d60 @store=#<Concurrent::map:0x00000000062dc4 entries=3 default_proc=nil>, @structured_lookup_mutex=#Mutex:0x2ba48034, @fast_lookup=#<Concurrent::map:0x00000000062dc8 entries=59 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs, :"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2"]>, @metric=#<LogStash::Instrument::NamespacedNullMetric:0x2c436910 @metric=#<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x50474d60 @store=#<Concurrent::map:0x00000000062dc4 entries=3 default_proc=nil>, @structured_lookup_mutex=#Mutex:0x2ba48034, @fast_lookup=#<Concurrent::map:0x00000000062dc8 entries=59 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs]>, @logger=#<LogStash::Logging::Logger:0x49af8061 @logger=#Java::OrgApacheLoggingLog4jCore::Logger:0x6e7010e2>, @strategy=#<LogStash::OutputDelegatorStrategies::Shared:0x342b896 @output=<LogStash::Outputs::ElasticSearch hosts=>[http://localhost:9200], bulk_path=>"/_xpack/monitoring/_bulk?system_id=logstash&system_api_version=2&interval=1s", manage_template=>false, document_id=>"8dd5ff3a-28d7-45e5-95c9-45e72eab6f33", document_type=>"logstash", index=>"_data", sniffing=>false, user=>"logstash_system", password=>, ssl=>false, id=>"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_66f29a46-1bee-4a4d-91cc-9bca49f0da6b", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, action=>"index", ssl_certificate_verification=>true, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>>, @id="c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", @metric_events=#<LogStash::Instrument::NamespacedNullMetric:0x6d44f5fe @metric=#<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric_store=#<LogStash::Instrument::MetricStore:0x50474d60 @store=#<Concurrent::map:0x00000000062dc4 entries=3 default_proc=nil>, @structured_lookup_mutex=#Mutex:0x2ba48034, @fast_lookup=#<Concurrent::map:0x00000000062dc8 entries=59 default_proc=nil>>>>, @namespace_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs, :"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", :events]>, @output_class=LogStash::Outputs::ElasticSearch>", :error=>"HttpClientBuilder not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.http.impl, org.apache.http.impl.client, org.apache.http.impl.conn, org.apache.http.impl.auth, org.apache.http.entity, org.apache.http.message, org.apache.http.params, org.apache.http.protocol, org.apache.http.auth, java.util.concurrent, org.apache.http.client.protocol, org.apache.http.conn.ssl, java.security.cert, java.security.spec, java.security, org.apache.http.client.utils; last error: cannot load Java class org.apache.http.client.utils.HttpClientBuilder"}

[2017-11-06T14:09:57,547][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<NameError: HttpClientBuilder not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.http.impl, org.apache.http.impl.client, org.apache.http.impl.conn, org.apache.http.impl.auth, org.apache.http.entity, org.apache.http.message, org.apache.http.params, org.apache.http.protocol, org.apache.http.auth, java.util.concurrent, org.apache.http.client.protocol, org.apache.http.conn.ssl, java.security.cert, java.security.spec, java.security, org.apache.http.client.utils; last error: cannot load Java class org.apache.http.client.utils.HttpClientBuilder>, :backtrace=>["file:/usr/share/logstash/vendor/jruby/lib/jruby.jar!/jruby/java/core_ext/module.rb:45:in const_missing'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:382:inclient_builder'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:180:in initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:26:ininitialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:273:in build_adapter'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:277:inbuild_pool'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:60:in initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:101:increate_http_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:97:in build'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch.rb:230:inbuild_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/common.rb:24:in register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:inregister'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:41:in register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:268:inregister_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:279:in

4

Um, okay. I have no idea what's up here.

5

so will the logstash stops if the command terminal is in active?

6

Logstash will stop if your terminal closes, yes.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.