Logstash studdown seconds after starting on its own

Elastic Stack Logstash
1

hello, i was trying to start my logstash but it started and shutted down in a few seconds.
Does anyone have any idea to resolve this issue?

[2020-07-07T15:17:11,564][INFO ][logstash.runner          ] Logstash shut down.```
2

Can you provide more detailed log.

3

would this do

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/jars/jruby-complete-9.2.11.1.jar) to field java.io.Console.cs
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Sending Logstash logs to Z:/solar/ELKStack/LogStach/logstash-7.8.0/logs which is now configured via log4j2.properties
[2020-07-07T15:46:33,909][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-07-07T15:46:34,394][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.8.0", "jruby.version"=>"jruby 9.2.11.1 (2.5.7) 2020-03-25 b1f55b1a40 Java HotSpot(TM) 64-Bit Server VM 9.0.1+11 on 9.0.1+11 +indy +jit [mswin32-x86_64]"}
[2020-07-07T15:46:38,883][INFO ][org.reflections.Reflections] Reflections took 128 ms to scan 1 urls, producing 21 keys and 41 values
[2020-07-07T15:46:41,724][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[2020-07-07T15:46:42,172][WARN ][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://localhost:9200/"}
[2020-07-07T15:46:43,046][INFO ][logstash.outputs.elasticsearch][main] ES Output version determined {:es_version=>7}
[2020-07-07T15:46:43,054][WARN ][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2020-07-07T15:46:43,238][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//localhost:9200"]}
[2020-07-07T15:46:43,302][INFO ][logstash.outputs.elasticsearch][main] Using default mapping template
[2020-07-07T15:46:43,438][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["Z:/solar/ELKStack/LogStach/logstach_apachelog.conf"], :thread=>"#<Thread:0x3253dc1b run>"}
[2020-07-07T15:46:43,510][INFO ][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2020-07-07T15:46:43,606][INFO ][logstash.outputs.elasticsearch][main] Installing elasticsearch template to _template/logstash
[2020-07-07T15:47:43,842][WARN ][logstash.outputs.elasticsearch][main] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out {:url=>http://localhost:9200/, :error_message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[2020-07-07T15:47:43,850][ERROR][logstash.outputs.elasticsearch][main] Failed to install template. {:message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :backtrace=>["Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:334:in `perform_request_to_url'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:319:in `block in perform_request'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:414:in `with_connection'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:318:in `perform_request'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:326:in `block in Pool'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:352:in `template_put'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in `template_install'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:28:in `install'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in `install_template'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/common.rb:205:in `install_template'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/common.rb:49:in `block in setup_after_successful_connection'"]}
[2020-07-07T15:47:45,622][ERROR][logstash.javapipeline    ][main] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: Z://solar//ELKStack//LogStach//*.log>, :backtrace=>["Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.18/lib/logstash/inputs/file.rb:283:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.18/lib/logstash/inputs/file.rb:281:in `register'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:326:in `start_inputs'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:286:in `start_workers'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["Z:/solar/ELKStack/LogStach/logstach_apachelog.conf"], :thread=>"#<Thread:0x3253dc1b run>"}
[2020-07-07T15:47:45,670][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2020-07-07T15:47:46,022][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2020-07-07T15:47:51,065][INFO ][logstash.runner          ] Logstash shut down.```
4

Here is the error. Looks like you have specified relative path(wildcard) instead of absolute while running Logstash.

5

Elasticsearch Unreachable: [http://localhost:9200/]
Is elasticsearch started?

6

yes elasticsearch has started and is running

7

how to fix this?

8

Is xpack.monitoring activated?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.