# Logstash stopping and restatŕting every 5 seconds and is using more than 600% of cpu **URL:** \ **Category:** Logstash\ **Created:** [July 30, 2020, 10:31am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202 "2020-07-30T10:31:44Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 10:31am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/1 "2020-07-30T10:31:44Z")
Logstash is using ore than 600% cpu and is starting and stopping again, actually it is working fine for the filters but still the cpu issue is critical and i am getting below error in the logstash logs - ```auto [2020-07-30T10:27:15,100][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit [2020-07-30T10:27:38,009][FATAL][logstash.runner] An unexpected error occurred! {:error=>#, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:528:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:288:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:199:in `block in validate_all'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:198:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:305:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:263:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:88:in `
'"]} [2020-07-30T10:27:38,169][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit [2020-07-30T10:28:01,168][FATAL][logstash.runner] An unexpected error occurred! {:error=>#, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:528:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:288:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:199:in `block in validate_all'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:198:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:305:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:263:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:88:in `
'"]} [2020-07-30T10:28:01,327][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ``` it would be helpful if someone could help with this issue ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [July 30, 2020, 10:40am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/2 "2020-07-30T10:40:43Z")
Please share your configuration file. Do you have any configuration file in conf.d? or check your configuration file in this way and show message: ```auto /usr/share/logstash/bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/ ``` d ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 30, 2020, 10:53am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/3 "2020-07-30T10:53:41Z")
> [@hemant\_472](#): > > `Path "/usr/share/logstash/data/queue" must be a writable directory. It is not writable.` Did you make sure that Logsash has writing permissions for this directory? ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 10:54am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/4 "2020-07-30T10:54:47Z")
Hi @d.silwon the conf.d is an emty folder now but i am using the below configuration file for my data parsing - ```auto input { beats { port => "5044" } } filter { dissect { mapping => { "message" => "%{timestamp1->} %{+timestamp1} %{+timestamp1} %{Theatre} %{Product} %{Severity} %{Body}" "Body" => "%{1} %{2} %{3} %{4} %{5} %{6} %{7}" } } kv { source => "Body" } } output { elasticsearch { hosts => ["http://localhost:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } ``` please check ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [July 30, 2020, 11:00am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/5 "2020-07-30T11:00:23Z")
The conf file looks good. Please check what is suggested by @Jenni I have: drwxr-x---. 2 logstash logstash 6 Jun 25 07:37 /usr/share/logstash/data/queue ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 12:32pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/6 "2020-07-30T12:32:51Z")
Hi @Jenni i tried making it writable but same issues, can you please suggest how i can give permissions to logstash for this ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 12:33pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/7 "2020-07-30T12:33:50Z")
Hi @d.silwon is this the command i can use to give permission? ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [July 30, 2020, 12:36pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/8 "2020-07-30T12:36:38Z")
Show rights: ls -ld /usr/share/logstash/data/queue The rights you can change in this way: chmod 750 /usr/share/logstash/data/queue chown logstash.logstash /usr/share/logstash/data/queue but check it first. ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 12:48pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/9 "2020-07-30T12:48:16Z")
> [@d.silwon](#): > > ls -ld /usr/share/logstash/data/queue it is showing the rigts as below - drwxrwxr-x 2 root root 4096 Jun 16 14:18 /usr/share/logstash/data/queue should i change them? ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [July 30, 2020, 12:49pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/10 "2020-07-30T12:49:53Z")
> [@hemant\_472](#): > > root root I think you should change rights for owner and group, should be logstash logstash ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/11 "2020-07-30T13:11:00Z")
i changed it, now i am receiving the below error- ```auto [2020-07-30T13:08:28,542][FATAL][logstash.runner] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /usr/share/logstash/data/.lock, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:84)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:102)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:107)", "sun.nio.fs.UnixFileSystemProvider.newFileChannel(sun/nio/fs/UnixFileSystemProvider.java:177)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:287)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:335)", "org.logstash.FileLockFactory.obtainLock(org/logstash/FileLockFactory.java:89)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:471)", "org.jruby.javasupport.JavaMethod.invokeStaticDirect(org/jruby/javasupport/JavaMethod.java:373)", "RUBY.execute(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:377)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_0_dot_6_dot_5.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_0_dot_6_dot_5.lib.clamp.command.RUBY$method$run$0$ __VARARGS__ (usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/clamp_minus_0_dot_6_dot_5/lib/clamp//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.runner.run(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:263)", "usr.share.logstash.logstash_minus_core.lib.logstash.runner.RUBY$method$run$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/runner.rb)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.clamp_minus_0_dot_6_dot_5.lib.clamp.command.run(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132)", "usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:88)", "java.lang.invoke.MethodHandle.invokeWithArguments(java/lang/invoke/MethodHandle.java:627)", "org.jruby.Ruby.runScript(org/jruby/Ruby.java:1205)", "org.jruby.Ruby.runNormally(org/jruby/Ruby.java:1128)", "org.jruby.Ruby.runNormally(org/jruby/Ruby.java:1146)", "org.jruby.Ruby.runFromMain(org/jruby/Ruby.java:958)", "org.logstash.Logstash.run(org/logstash/Logstash.java:133)", "org.logstash.Logstash.main(org/logstash/Logstash.java:67)"]} [2020-07-30T13:08:28,706][ERROR][org.logs ``` ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 30, 2020, 1:13pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/12 "2020-07-30T13:13:41Z")
Did you change the permissions recursively or only for the top directory? ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 1:15pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/13 "2020-07-30T13:15:35Z")
yes i changed for another directory as well after that it was asking for this directory /usr/share/logstash/data/dead\_letter\_queue to be writable ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 30, 2020, 1:16pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/14 "2020-07-30T13:16:45Z")
But did you give it permissions for /usr/share/logstash/data/.lock? ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [July 30, 2020, 1:28pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/15 "2020-07-30T13:28:03Z")
no i gave permissions for /usr/share/logstash/data/queue should i give permissions to /usr/share/logstash/data/.lock ? and using these comaands ?- chmod 750 /usr/share/logstash/data/.lock chown logstash.logstash /usr/share/logstash/data/.lock ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [July 30, 2020, 2:30pm UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/16 "2020-07-30T14:30:15Z")
> [@hemant\_472](#): > > /usr/share Please do it in this way: cd /usr/share chown -R logstash.logstash logstash ---
**Author:** ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Post date:** [August 19, 2020, 8:46am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/17 "2020-08-19T08:46:19Z")
i tried this i think the issue is still there, i get the below messages ```auto [2020-08-19T08:45:11,922][INFO][org.logstash.beats.Server][main][a69701381b84e5bb13a99bcc92b9d3f1af97f5ac476344c6ab73bc10e6944c57] Starting server on port: 5044 [2020-08-19T08:45:18,142][ERROR][logstash.javapipeline][main][a69701381b84e5bb13a99bcc92b9d3f1af97f5ac476344c6ab73bc10e6944c57] A plugin had an unrecoverable error. Will restart this plugin. Pipeline_id:main Plugin: 5044, id=>"a69701381b84e5bb13a99bcc92b9d3f1af97f5ac476344c6ab73bc10e6944c57", enable_metric=>true, codec=>"plain_df7eaa0d-08b5-4237-9d91-34d05dab2627", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, add_hostname=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>16> Error: Address already in use Exception: Java::JavaNet::BindException Stack: sun.nio.ch.Net.bind0(Native Method) sun.nio.ch.Net.bind(sun/nio/ch/Net.java:433) sun.nio.ch.Net.bind(sun/nio/ch/Net.java:425) sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:220) io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:130) io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:558) io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1358) io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:501) io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:486) io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:1019) io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:254) io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:366) io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:163) io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:404) io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:462) io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:897) io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30) java.lang.Thread.run(java/lang/Thread.java:748) [2020-08-19T08:45:19,144][INFO][org.logstash.beats.Server][main][a69701381b84e5bb13a99bcc92b9d3f1af97f5ac476344c6ab73bc10e6944c57] Starting server on port: 5044 ``` ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [August 31, 2020, 9:54am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/18 "2020-08-31T09:54:54Z")
> [@hemant\_472](#): > > `Error: Address already in use` Hi, But the error is different right now. Please solve it. Regrads, Daniel ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2020, 9:54am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202/19 "2020-09-28T09:54:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.