Multiple-pipelines

[hispeed]

Hi,

Everything worked on 5.6 so I made a snapshot and updated to V.6.0. All services are running fine.

I have winlogbeat sending logs to logstash and I have a Pfsense and other stuff comming in directly to logstash.
Do I now use multiple pipelines?

I also use the geolite plugin. At the moment there is nothing configured in logstash.yml. It looks like there a lot of changes in V.6.0.

I get the following error:

[2017-11-27T20:26:02,621][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2017-11-27T20:26:02,625][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2017-11-27T20:26:02,948][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2017-11-27T20:26:02,977][FATAL][logstash.runner ] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /var/lib/logstash/.lock, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:84)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:102)",

Does anyone has some ideas?

Best Regards,
Marc

[magnusbaeck (Magnus Bäck)]

java.nio.file.AccessDeniedException: /var/lib/logstash/.lock

Wrong permissions or ownership of this file or directory?

[hispeed]

Hi,

i have the following rights:

drwxr-xr-x 4 logstash logstash 69 10. Nov 21:03 .
drwxr-xr-x. 29 root root 4096 29. Nov 08:02 ..
drwxrwxrwx 2 986 984 6 7. Aug 20:59 dead_letter_queue
-rwxr-xr-x 1 986 984 0 10. Mai 2017 .lock
drwxrwxrwx 2 986 984 6 10. Mai 2017 queue
-rw-r--r-- 1 986 984 36 13. Feb 2017 uuid

[magnusbaeck (Magnus Bäck)]

The directory is owned by the logstash user (which is expected) but the other files are owned by the user with uid 986. Pick a user to run Logstash as and make sure the file permissions reflect your choice.