Logstash studdown seconds after starting on its own

hello, i was trying to start my logstash but it started and shutted down in a few seconds.
Does anyone have any idea to resolve this issue?

[2020-07-07T15:17:11,564][INFO ][logstash.runner          ] Logstash shut down.```

Can you provide more detailed log.

would this do

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/jars/jruby-complete-9.2.11.1.jar) to field java.io.Console.cs
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Sending Logstash logs to Z:/solar/ELKStack/LogStach/logstash-7.8.0/logs which is now configured via log4j2.properties
[2020-07-07T15:46:33,909][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-07-07T15:46:34,394][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.8.0", "jruby.version"=>"jruby 9.2.11.1 (2.5.7) 2020-03-25 b1f55b1a40 Java HotSpot(TM) 64-Bit Server VM 9.0.1+11 on 9.0.1+11 +indy +jit [mswin32-x86_64]"}
[2020-07-07T15:46:38,883][INFO ][org.reflections.Reflections] Reflections took 128 ms to scan 1 urls, producing 21 keys and 41 values
[2020-07-07T15:46:41,724][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[2020-07-07T15:46:42,172][WARN ][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://localhost:9200/"}
[2020-07-07T15:46:43,046][INFO ][logstash.outputs.elasticsearch][main] ES Output version determined {:es_version=>7}
[2020-07-07T15:46:43,054][WARN ][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2020-07-07T15:46:43,238][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//localhost:9200"]}
[2020-07-07T15:46:43,302][INFO ][logstash.outputs.elasticsearch][main] Using default mapping template
[2020-07-07T15:46:43,438][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["Z:/solar/ELKStack/LogStach/logstach_apachelog.conf"], :thread=>"#<Thread:0x3253dc1b run>"}
[2020-07-07T15:46:43,510][INFO ][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2020-07-07T15:46:43,606][INFO ][logstash.outputs.elasticsearch][main] Installing elasticsearch template to _template/logstash
[2020-07-07T15:47:43,842][WARN ][logstash.outputs.elasticsearch][main] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out {:url=>http://localhost:9200/, :error_message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[2020-07-07T15:47:43,850][ERROR][logstash.outputs.elasticsearch][main] Failed to install template. {:message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketTimeout] Read timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :backtrace=>["Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:334:in `perform_request_to_url'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:319:in `block in perform_request'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:414:in `with_connection'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:318:in `perform_request'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:326:in `block in Pool'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:352:in `template_put'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in `template_install'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:28:in `install'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in `install_template'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/common.rb:205:in `install_template'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/common.rb:49:in `block in setup_after_successful_connection'"]}
[2020-07-07T15:47:45,622][ERROR][logstash.javapipeline    ][main] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: Z://solar//ELKStack//LogStach//*.log>, :backtrace=>["Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.18/lib/logstash/inputs/file.rb:283:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.18/lib/logstash/inputs/file.rb:281:in `register'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:326:in `start_inputs'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:286:in `start_workers'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "Z:/solar/ELKStack/LogStach/logstash-7.8.0/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["Z:/solar/ELKStack/LogStach/logstach_apachelog.conf"], :thread=>"#<Thread:0x3253dc1b run>"}
[2020-07-07T15:47:45,670][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2020-07-07T15:47:46,022][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2020-07-07T15:47:51,065][INFO ][logstash.runner          ] Logstash shut down.```

Here is the error. Looks like you have specified relative path(wildcard) instead of absolute while running Logstash.

Elasticsearch Unreachable: [http://localhost:9200/]
Is elasticsearch started?

yes elasticsearch has started and is running

how to fix this?

Is xpack.monitoring activated?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.