# Logtash pid keeps changing

**URL:** <https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073>\
**Category:** Logstash\
**Created:** [May 26, 2021, 2:21pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073 "2021-05-26T14:21:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cyberfence](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cyberfence](https://discuss.elastic.co/u/cyberfence)\
**Post date:** [May 26, 2021, 2:21pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/1 "2021-05-26T14:21:43Z")

</div>

I am currently running ubuntu 18 server edition and the following is java / logstash version

root@monitor:/usr/share/logstash/bin# ./logstash --version  
Using JAVA\_HOME defined java: /usr/lib/jvm/java-1.8.0-openjdk-amd64  
WARNING, using JAVA\_HOME while Logstash distribution comes with a bundled JDK  
logstash 7.13.0

here is service status: it is green

root@monitor:/usr/share/logstash/bin# sudo service logstash status  
● logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: enabled)  
Active: active (running) since Wed 2021-05-26 14:19:14 UTC; 36s ago  
Main PID: 4699 (java)  
Tasks: 14 (limit: 4915)  
CGroup: /system.slice/logstash.service  
└─4699 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava

May 26 14:19:14 monitor systemd[1]: Started logstash.  
May 26 14:19:15 monitor logstash[4699]: Using bundled JDK: /usr/share/logstash/jdk  
May 26 14:19:15 monitor logstash[4699]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future

When I do netstat -ntpl I do not see port 9600 and also the PID for logstash keeps changing every (I think 30 seconds or so)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2021, 2:28pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/2 "2021-05-26T14:28:06Z")

</div>

If it is constantly restarting you will need to review the logstash logs.

---

<div class="post-metadata">

**Author:** ![cyberfence](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cyberfence](https://discuss.elastic.co/u/cyberfence)\
**Post date:** [May 26, 2021, 2:42pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/3 "2021-05-26T14:42:28Z")

</div>

I am very new to this.

Thank you very much, it looks I have a lead, please confirm if I am doing this right.

My tutor, I believe, was using an older version of Logstash and asked us to configure .yml files in conf.d folder, log file was complaining of no .conf files in the folder. I changed extension of all files to .conf and I can now see a constant PID and ports 9600 is already listening.

is that it?

I changed extension of all of them (log fil

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2021, 3:03pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/4 "2021-05-26T15:03:09Z")

</div>

> [@cyberfence](#):
>
> I changed extension of all files to .conf and I can now see a constant PID and ports 9600 is already listening.

That sounds like it is running OK.

---

<div class="post-metadata">

**Author:** ![cyberfence](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cyberfence](https://discuss.elastic.co/u/cyberfence)\
**Post date:** [May 26, 2021, 3:17pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/5 "2021-05-26T15:17:54Z")

</div>

> [@Badger](#):
>
> If it is cons

Thank you very much for pointing towards logs!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2021, 3:17pm UTC](https://discuss.elastic.co/t/logtash-pid-keeps-changing/274073/6 "2021-06-23T15:17:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.