# Logstash starting queries

**URL:** <https://discuss.elastic.co/t/logstash-starting-queries/106532>\
**Category:** Logstash\
**Created:** [November 6, 2017, 1:25pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532 "2017-11-06T13:25:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [November 6, 2017, 1:25pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/1 "2017-11-06T13:25:01Z")

</div>

Hi All,

I have been using ELastic stack for parsing syslog and store it in elasticsearch, but i have problem in starting the service the logstash,

When i start the logstash like , service logstash start , it crashes but if I use it

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --debug , it runs and it outputs the data , but if I start like this lets says my command terminal is inactive after few hours will the service stops or still it work as init.d service.

Sorry if its silly question,but I want understand it .

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/2 "2017-11-06T14:05:51Z")

</div>

> When i start the logstash like , service logstash start , it crashes

Have you looked in the logs for clues about why this might happen?

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [November 6, 2017, 2:21pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/3 "2017-11-06T14:21:09Z")

</div>

Thanks for the reply ,  
Something like this

[2017-11-06T14:09:57,539][ERROR][logstash.pipeline] Error registering plugin {:plugin=\>"#\<LogStash::OutputDelegator:0xecedf92 @namespaced\_metric=#\<LogStash::Instrument::NamespacedNullMetric:0x79a04703 @metric=#\<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#\<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x50474d60 @store=#\<Concurrent:🗺0x00000000062dc4 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x2ba48034, @fast\_lookup=#\<Concurrent:🗺0x00000000062dc8 entries=59 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs, :"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2"]\>, @metric=#\<LogStash::Instrument::NamespacedNullMetric:0x2c436910 @metric=#\<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#\<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x50474d60 @store=#\<Concurrent:🗺0x00000000062dc4 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x2ba48034, @fast\_lookup=#\<Concurrent:🗺0x00000000062dc8 entries=59 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs]\>, @logger=#\<LogStash::Logging::Logger:0x49af8061 @logger=#Java::OrgApacheLoggingLog4jCore::Logger:0x6e7010e2\>, @strategy=#\<LogStash::OutputDelegatorStrategies::Shared:0x342b896 @output=\<LogStash::Outputs::ElasticSearch hosts=\>[[http://localhost:9200](http://localhost:9200)], bulk\_path=\>"/\_xpack/monitoring/\_bulk?system\_id=logstash&system\_api\_version=2&interval=1s", manage\_template=\>false, document\_id=\>"8dd5ff3a-28d7-45e5-95c9-45e72eab6f33", document\_type=\>"logstash", index=\>"\_data", sniffing=\>false, user=\>"logstash\_system", password=\>, ssl=\>false, id=\>"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Plain id=\>"plain\_66f29a46-1bee-4a4d-91cc-9bca49f0da6b", enable\_metric=\>true, charset=\>"UTF-8"\>, workers=\>1, template\_name=\>"logstash", template\_overwrite=\>false, doc\_as\_upsert=\>false, script\_type=\>"inline", script\_lang=\>"painless", script\_var\_name=\>"event", scripted\_upsert=\>false, retry\_initial\_interval=\>2, retry\_max\_interval=\>64, retry\_on\_conflict=\>1, action=\>"index", ssl\_certificate\_verification=\>true, sniffing\_delay=\>5, timeout=\>60, pool\_max=\>1000, pool\_max\_per\_route=\>100, resurrect\_delay=\>5, validate\_after\_inactivity=\>10000, http\_compression=\>false\>\>, @id="c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", @metric\_events=#\<LogStash::Instrument::NamespacedNullMetric:0x6d44f5fe @metric=#\<LogStash::Instrument::NullMetric:0x76a60cc9 @collector=#\<LogStash::Instrument::Collector:0x280d35bc @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x50474d60 @store=#\<Concurrent:🗺0x00000000062dc4 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x2ba48034, @fast\_lookup=#\<Concurrent:🗺0x00000000062dc8 entries=59 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :".monitoring-logstash", :plugins, :outputs, :"c6b036fadede7a1e3e9769b63f0aaa05ac000bd2-2", :events]\>, @output\_class=LogStash::Outputs::ElasticSearch\>", :error=\>"HttpClientBuilder not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.http.impl, org.apache.http.impl.client, org.apache.http.impl.conn, org.apache.http.impl.auth, org.apache.http.entity, org.apache.http.message, org.apache.http.params, org.apache.http.protocol, org.apache.http.auth, java.util.concurrent, org.apache.http.client.protocol, org.apache.http.conn.ssl, java.security.cert, java.security.spec, java.security, org.apache.http.client.utils; last error: cannot load Java class org.apache.http.client.utils.HttpClientBuilder"}

[2017-11-06T14:09:57,547][ERROR][logstash.agent] Pipeline aborted due to error {:exception=\>#\<NameError: HttpClientBuilder not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.http.impl, org.apache.http.impl.client, org.apache.http.impl.conn, org.apache.http.impl.auth, org.apache.http.entity, org.apache.http.message, org.apache.http.params, org.apache.http.protocol, org.apache.http.auth, java.util.concurrent, org.apache.http.client.protocol, org.apache.http.conn.ssl, java.security.cert, java.security.spec, java.security, org.apache.http.client.utils; last error: cannot load Java class org.apache.http.client.utils.HttpClientBuilder\>, :backtrace=\>["file:/usr/share/logstash/vendor/jruby/lib/jruby.jar!/jruby/java/core\_ext/module.rb:45:in `const_missing'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:382:in`client\_builder'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:180:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:26:in`initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:273:in `build_adapter'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:277:in`build\_pool'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:60:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:101:in`create\_http\_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/http\_client\_builder.rb:97:in `build'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch.rb:230:in`build\_client'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/common.rb:24:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator.rb:41:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:268:in`register\_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:279:in

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2017, 2:31pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/4 "2017-11-06T14:31:30Z")

</div>

Um, okay. I have no idea what's up here.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [November 6, 2017, 2:43pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/5 "2017-11-06T14:43:25Z")

</div>

so will the logstash stops if the command terminal is in active?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2017, 3:00pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/6 "2017-11-06T15:00:43Z")

</div>

Logstash will stop if your terminal closes, yes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2017, 3:01pm UTC](https://discuss.elastic.co/t/logstash-starting-queries/106532/7 "2017-12-04T15:01:00Z")

</div>

Closed on December 4, 2017, 3:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.