Logstash stopped processing because of an error: (SystemExit) exit

Hi

I am getting the error when I run the config file through 'systemctl start logstash'

log----
[2021-12-15T13:49:55,003][INFO ][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2021-12-15T13:49:55,016][INFO ][logstash.runner] Starting Logstash {"logstash.version"=>"7.16.1", "jruby.version"=>"jruby 9.
2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]"}
[2021-12-15T13:49:55,450][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

I have found that "uuid" file is not present in /var/lib/logstash/ path
and also I am not able to delete ".lock" file, it says file not found. (tried this as work around as suggested for another case.)

Is this the result of upgrading an existing installation?

A change in permissions on /usr/share/logstash from logstash to root took place in 7.13.0. Can you check the permissions on the data folder under /usr/share/logstash , which I suspect may have been changed to root during the upgrade.

To get the up and running again, we should be able to change the permissions of the data path under /usr/share/logstash/ to the logstash user, rather than root .

Is this the result of upgrading an existing installation? -- not sure. I did not run this logstash before upgradation.

I have changed the he permissions of the data path under /usr/share/logstash/ to the logstash user but I cannot see any difference. I am still getting the same error.

Thank you @yaauie

Issue is resolved.

I have changed the permission of all the files under '/etc/logstash/' and '/usr/share/logsash' to logstash from root.
chwon logstash: *

From a security standpoint, the Logstash user should
not have ownership of the Logstash installation. It should only have read permission on its installation, and write permission on only its data directory.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.