Logstash stopped processing because of an error: (SystemExit) exit

Elastic Stack Logstash
1

Hi,

After instaling/configuring logstash, I get this error:

[2022-03-11T09:22:27,379][INFO ][logstash.runner ] Log4j configuration path used is: /u02/logstash_frontend/etc/log4j2.properties
[2022-03-11T09:22:27,398][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"8.1.0", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +jit [linux-x86_64]"}
[2022-03-11T09:22:27,404][INFO ][logstash.runner ] JVM bootstrap flags:
[2022-03-11T09:22:27,772][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby.jar:?]
at u01.logstash.lib.bootstrap.environment.(/u01/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

Other topics mention data directory that should be of user logstash, which it is. So that's not the cause. Also the lib directory should be open to user logstash, also not the cause.

Is there some other way to find out anything on the root cause of this error?

thanks

2

Hi, I am a colleague of Paul. We run on RedHat 7.9

3

How are you starting logstash? This is the full log you are getting?

Share your logstash.yml file as well.

4

Hi Leandro, thanks for responding.
We don't have any config yet, no pipelines whatsoever. This is the logstash.yml:

cat logstash.yml
path.data: "/u02/logstash_frontend/data"
path.queue: "/u02/logstash_frontend/queue"
path.logs: "/u02/logstash_frontend/log"

We start it with "systemctl start logstash_frontend".

And yes, unfortunately that is the full log.

5

Logstash won't start without a config file, you need at least one configuration with a working input and output, if you do not have a config file logstash has nothing to do and won't start.

But you should have a line that says something like no config file found in the logs, can you check for that?

7

Hi Leandro, we tried some stuff this afternoon. And we have our logstash user (logstash_frontend) in group logstash. And everyone in group logstash should be able to read/write in the logstash folder (and subfolders like /data). But we made a mistake with the folder permissions.... duh...

Anyway, strange thing is that starting with systemctl no specific log (only "... stopped because of an error".

While starting it from command line we got on error on jvm.options file


/u01/logstash/bin/logstash "--path.settings" "/u02/logstash_frontend/etc"

Using bundled JDK: /u01/logstash/jdk
encountered [2] errors parsing [/u02/logstash_frontend/etc/jvm.options][1]: encountered improperly formatted JVM option in [/u02/logstash_frontend/etc/jvm.options] on line number [20]: [11-13:#-XX:+UseConcMarkSweepGC][2]: encountered improperly formatted JVM option in [/u02/logstash_frontend/etc/jvm.options]

I know this is not the folder permission error, we found that later.

Kind regards,
Mark

8

Did you change the default jvm.options?

It says that the error is on line 20, from the error log it seems that this line is wrongly formatted in your jvm.options.

It shows as:

11-13:#-XX:+UseConcMarkSweepGC

The # is in a wrong position, if you want to comment this line you should but the # at the beginning.

#11-13:-XX:+UseConcMarkSweepGC
1 Like
9

Hi,

Yes, the problem was that we in our postinstall modified the jvm.options but in wrong way (placing the # in wrong position).

I have adapted our scripts so won’t occur any more. Our issues are solved now.

1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.