Logstash stopped processing because of an error: (SystemExit) exit

Elastic Stack Logstash
1

Hi

I am getting the error when I run the config file through 'systemctl start logstash'

log----
[2021-12-15T13:49:55,003][INFO ][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2021-12-15T13:49:55,016][INFO ][logstash.runner] Starting Logstash {"logstash.version"=>"7.16.1", "jruby.version"=>"jruby 9.
2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]"}
[2021-12-15T13:49:55,450][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

I have found that "uuid" file is not present in /var/lib/logstash/ path
and also I am not able to delete ".lock" file, it says file not found. (tried this as work around as suggested for another case.)

image
image742×97 3.4 KB

2

Is this the result of upgrading an existing installation?

A change in permissions on /usr/share/logstash from logstash to root took place in 7.13.0. Can you check the permissions on the data folder under /usr/share/logstash , which I suspect may have been changed to root during the upgrade.

To get the up and running again, we should be able to change the permissions of the data path under /usr/share/logstash/ to the logstash user, rather than root .

3

Is this the result of upgrading an existing installation? -- not sure. I did not run this logstash before upgradation.

I have changed the he permissions of the data path under /usr/share/logstash/ to the logstash user but I cannot see any difference. I am still getting the same error.

5

Thank you @yaauie

Issue is resolved.

I have changed the permission of all the files under '/etc/logstash/' and '/usr/share/logsash' to logstash from root.
chwon logstash: *

6

From a security standpoint, the Logstash user should
not have ownership of the Logstash installation. It should only have read permission on its installation, and write permission on only its data directory.