Multiple-pipelines

Hi,

Everything worked on 5.6 so I made a snapshot and updated to V.6.0. All services are running fine.

I have winlogbeat sending logs to logstash and I have a Pfsense and other stuff comming in directly to logstash.
Do I now use multiple pipelines?

I also use the geolite plugin. At the moment there is nothing configured in logstash.yml. It looks like there a lot of changes in V.6.0.

I get the following error:

[2017-11-27T20:26:02,621][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2017-11-27T20:26:02,625][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2017-11-27T20:26:02,948][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2017-11-27T20:26:02,977][FATAL][logstash.runner ] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /var/lib/logstash/.lock, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:84)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:102)",

Does anyone has some ideas?

Best Regards,
Marc

java.nio.file.AccessDeniedException: /var/lib/logstash/.lock

Wrong permissions or ownership of this file or directory?

Hi,

i have the following rights:

drwxr-xr-x 4 logstash logstash 69 10. Nov 21:03 .
drwxr-xr-x. 29 root root 4096 29. Nov 08:02 ..
drwxrwxrwx 2 986 984 6 7. Aug 20:59 dead_letter_queue
-rwxr-xr-x 1 986 984 0 10. Mai 2017 .lock
drwxrwxrwx 2 986 984 6 10. Mai 2017 queue
-rw-r--r-- 1 986 984 36 13. Feb 2017 uuid

The directory is owned by the logstash user (which is expected) but the other files are owned by the user with uid 986. Pick a user to run Logstash as and make sure the file permissions reflect your choice.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.