# Logstash upstart service failed to start after logstash.log remove

**URL:** <https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779>\
**Category:** Logstash\
**Created:** [September 5, 2016, 6:23am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779 "2016-09-05T06:23:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cazorla19](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@cazorla19](https://discuss.elastic.co/u/cazorla19)\
**Post date:** [September 5, 2016, 6:23am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779/1 "2016-09-05T06:23:12Z")

</div>

The issue: facing with disk space deficiency, I remove in panic all stuffy log files. File logstash.log was there too. After further attempts to start service touching empty file logstash.log before. Service status became active, but exited. Actually logstash process didn't start at all and I couldn't see anything in /var/log/logstash, where .log, .err and .stdout files stored. There was no line about process start at these files.  
Although the process itself is running well from the command...

```
/opt/logstash/bin/logstash -f /etc/logstash/conf.d >> /var/log/logstash.log 2>&1 &

```

Just upstart service is not running.  
I've thought it through, probably there must be file permissions issue. I checked out service is running successfully from logstash user and user itself can write to log. But upstart daemon isn't working after logstash.log file remove. Probably there must be OS service orchestration. I'm on Ubuntu 16.04 where systemd is default, but logstash still gets a script from /etc/init.d to be run.  
Trying all basic solutions I still can't understand why upstart service stopped to run. Please, help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 5, 2016, 6:37am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779/2 "2016-09-05T06:37:58Z")

</div>

Is there anything in the upstart logs?

---

<div class="post-metadata">

**Author:** ![cazorla19](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@cazorla19](https://discuss.elastic.co/u/cazorla19)\
**Post date:** [September 5, 2016, 8:27am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779/3 "2016-09-05T08:27:42Z")

</div>

Nothing! That's much more interesting.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/logstash-upstart-service-failed-to-start-after-logstash-log-remove/59779/4 "2017-07-06T04:39:56Z")

</div>

Closed on July 6, 2017, 4:39am UTC