# Logstash stopped processing because of an error **URL:** \ **Category:** Logstash\ **Created:** [June 19, 2024, 9:03am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716 "2024-06-19T09:03:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![SIM\_Vik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sim_vik/32/130656_2.png) [@SIM\_Vik](https://discuss.elastic.co/u/SIM_Vik)\ **Post date:** [June 19, 2024, 9:03am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716/1 "2024-06-19T09:03:14Z")
I tried many solutions from other topics, but they didn’t help me. I installed logstash, wrote conf and now logstash can’t start, what am I doing wrong. I run logstash via systemctl - logstash-plain.log ```auto [2024-06-19T11:49:24,129][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties [2024-06-19T11:49:24,138][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"8.11.1", "jruby.version"=>"jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.9+9 on 17.0.9+9 +indy +jit [x86_64-linux]"} [2024-06-19T11:49:24,140][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2024-06-19T11:49:24,151][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:795) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:758) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?] ``` - con file ```auto input { beats { port => 5044 } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { elasticsearch { hosts => ["https://localhost:9200"] ssl => true ssl_certificate_verification => false manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" user => ***** password => " *****" } } ``` - pipeline.yml ```auto -pipeline.id: main path.config: "/etc/logstash/conf.d/*.conf" ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 19, 2024, 11:08am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716/2 "2024-06-19T11:08:07Z")
> [@SIM\_Vik](#): > > ```auto > [2024-06-19T11:49:24,151][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit > org.jruby.exceptions.SystemExit: (SystemExit) exit > > ``` Try enabling log.level debug to see if you get an additional message. ---
**Author:** ![SIM\_Vik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sim_vik/32/130656_2.png) [@SIM\_Vik](https://discuss.elastic.co/u/SIM_Vik)\ **Post date:** [June 19, 2024, 11:24am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716/3 "2024-06-19T11:24:31Z")
```auto [2024-06-19T14:22:45,252][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2024-06-19T14:22:45,253][DEBUG][logstash.modules.scaffold] Found module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"} [2024-06-19T14:22:45,253][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"fb_apache", :type=>:modules, :class=>#} [2024-06-19T14:22:45,254][DEBUG][logstash.modules.scaffold] Found module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"} [2024-06-19T14:22:45,254][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"netflow", :type=>:modules, :class=>#} [2024-06-19T14:22:45,264][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:795) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:758) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?] ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [June 19, 2024, 12:12pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716/4 "2024-06-19T12:12:11Z")
You need to check on the system logs, try to start it again and look at `/var/log/messages` or `/var/log/syslog`, depending on the distribution, for any hints about why the service can not start. Something may be wrong with your configurations and systemd cannot start the logstash service, you will not get the error for this in logstash logs. Another thing: Is this the structure of your `pipelines.yml` or it is just a typo while copying? The indentation is wrong > [@SIM\_Vik](#): > > ```auto > -pipeline.id: main > path.config: "/etc/logstash/conf.d/*.conf" > > ``` It should be: ```auto - pipeline.id: main path.config: "/etc/logstash/conf.d/*.conf" ``` ---
**Author:** ![SIM\_Vik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sim_vik/32/130656_2.png) [@SIM\_Vik](https://discuss.elastic.co/u/SIM_Vik)\ **Post date:** [June 20, 2024, 7:02am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/361716/5 "2024-06-20T07:02:56Z")
> [@leandrojmp](#): > > You need to check on the system logs, try to start it again and look at `/var/log/messages` or `/var/log/syslog`, depending on the distribution, for any hints about why the service can not start. > > Something may be wrong with your configurations and systemd cannot start the logstash service, you will not get the error for this in logstash logs. Thank you, I found the source of the problem in syslog, I needed to change the permissions in `/var/lib/logstash`