New logstash installation is not working

Elastic Stack Logstash
1

Hello I want to install logstash in red hat linux 9. according with this documentation, because i need this specific version.

I followed the instructions.

downloaded from the github the version, and using jdk 11 from oracle.

I used this environment variables

MY_RUBY_HOME=/home/admin/jruby-9.4.13.0
LOGSTASH_CORE=/home/admin/logstash/logstash/logstash-core
LOGSTASH_CORE_PATH=/home/admin/logstash/logstash/logstash-core
GEM_PATH=/home/admin/jruby-9.4.13.0/gems
GEM_HOME=/home/admin/jruby-9.4.13.0/gems
LS_HOME=/home/admin/logstash/logstash

I downloaded the plugin source code and generated gem, but when i try to upload to logstash

logstash-plugin install --no-verify --local ./logstash-filter-java_filter_example-1.0.3.gem

[root@rh9v logstash-filter-java_filter_example]# logstash-plugin install --no-verify --local ./logstash-filter-java_filter_example-1.0.3.gem
Using system java: /bin/java
Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
LoadError: no such file to load -- clamp
** require at org/jruby/RubyKernel.java:974**
** require at** /home/admin/logstash/logstash/vendor/jruby/lib/ruby/stdlib/rubygems/core_ext/kernel_require.rb:83

at /home/admin/logstash/logstash/lib/pluginmanager/main.rb:30 [root@rh9v logstash-filter-java_filter_example]#

I had this error, and i dont know why this error,

if i use

gem list

[root@rh9v logstash-filter-java_filter_example]# gem list

*** LOCAL GEMS ***

abbrev (default: 0.1.0)
base64 (default: 0.1.1)
benchmark (default: 0.2.0)
bigdecimal (default: 3.1.4 java)
bundler (default: 2.6.3)
cgi (default: 0.3.6 java)
clam (0.0.1)
csv (default: 3.2.5)
date (default: 3.3.3 java)
debug (default: 0.2.1)
delegate (default: 0.2.0)
did_you_mean (default: 1.6.1)
digest (default: 3.1.0 java)
drb (default: 2.1.0)
english (default: 0.7.1)
erb (default: 2.2.3)
error_highlight (default: 0.3.0)
ffi (default: 1.16.3 java)
ffi-binary-libfixposix (default: 0.5.1.1 java)
ffi-bindings-libfixposix (default: 0.5.1.0)
fiddle (default: 1.1.4)
fileutils (default: 1.6.0)
find (default: 0.1.1)
forwardable (default: 1.3.2)
getoptlong (default: 0.1.1)
io-console (default: 0.7.2 java)
io-wait (default: 0.3.0 java)
ipaddr (default: 1.2.4)
irb (default: 1.4.2)
jar-dependencies (default: 0.5.4)
jruby-openssl (default: 0.15.4 java)
jruby-readline (default: 1.3.7 java)
json (default: 2.7.1 java)
logger (default: 1.5.1)
mutex_m (default: 0.1.1)
net-http (default: 0.3.0)
net-protocol (default: 0.1.2)
nkf (default: 0.2.0 java)
observer (default: 0.1.1)
open-uri (default: 0.3.0)
open3 (default: 0.1.2)
optparse (default: 0.2.0)
ostruct (default: 0.5.5)
pp (default: 0.3.0)
prettyprint (default: 0.1.1)
pstore (default: 0.1.1)
psych (default: 5.2.3 java)
racc (default: 1.6.0 java)
rake-ant (default: 1.0.6)
rdoc (default: 6.4.1.1)
reline (default: 0.5.12)
resolv-replace (default: 0.1.0)
rinda (default: 0.1.1)
ruby2_keywords (default: 0.0.5)
rubygems-update (default: 3.6.3)
securerandom (default: 0.2.0)
shellwords (default: 0.1.0)
singleton (default: 0.1.1)
stringio (default: 3.1.5 java)
strscan (default: 3.1.0 java)
subspawn (default: 0.1.1)
subspawn-posix (default: 0.1.1)
time (default: 0.2.2)
timeout (default: 0.3.2)
tsort (default: 0.1.0)
un (default: 0.2.0)
uri (default: 0.12.3)
weakref (default: 0.1.1)
yaml (default: 0.2.0)
[root@rh9v logstash-filter-java_filter_example]#

2

The link you provided is not the installation documentation. Here is the correct one:

3

Your issue is not about installing Logstash, is about building a custom plugin.

What is the Logstash version you are using? You didn't specify, please provide exact Logstash version you are using to check if you are using the correct documentation.

4

hello im using version 7.1

5

Please check

It might not the reason your plugin build is failing, but note that Logstash 7.1.x is not supported on RHEL 9, nor RHEL 8 as it happens. By my reading, 8.4.x is first release to support RHEL 9.

6

Yeah, couple of issues here, if you are on version 7.1 you need to check the documentation of this specific version, you shared a documentation for 7.16, you need to check the steps on the documentation for 7.1 as they may be different, you can find it here.

Another issue is version 7 is not supported anymore and it was never supported on RHEL 9, so you are testing both an unsupported version on an unsupported system for that version.

Any issue you have you would need to replicated on supported versions on supported systems.

Is pretty complicated to troubleshoot things that are that old and not supported.

7

hello following the recomendations that you kindlyme posted

I changed logstash version to 9.0.3, that is supported in RH9 according to support matrix.

[root@rh9v logstash]# logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 9.0.3
[root@rh9v logstash]#

but still has the same problem

SHELL=/bin/bash
SUDO_GID=1000
HOSTNAME=rh9v.lab
HISTSIZE=1000
JAVA_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
SUDO_COMMAND=/bin/bash
SUDO_USER=admin
PWD=/usr/share/logstash
LOGNAME=root
MODULESHOME=/usr/share/Modules
MANPATH=/usr/share/man:
LS_H0ME=/usr/share/logstash
LOGSTASH_CORE=/usr/share/logstash/logstash-core

[root@rh9v logstash]# logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[FATAL] 2025-07-05 21:46:05.890 [main] runner - An unexpected error occurred! {:error=>#<RuntimeError: Logstash cannot be run as superuser.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/runner.rb:430:in running_as_superuser'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:259:in execute'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:66:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:249:in run'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:140:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:89:in '"]}
[FATAL] 2025-07-05 21:46:05.902 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[root@rh9v logstash]#

8

Is that not clear? Running logstash as root is a terrible idea, so the latest version tries to stop you doing it.

If you really want to run as root then you can disable the check. The release notes mention it.

In logstash.yml for 9.x you should find

# Allow or block running Logstash as superuser (default: true)
# allow_superuser: false

Note that the comment (default: true) is simply wrong. The default in V9.0 is false, as implemented in PR 16558.

9

I tried to run with a normal user

with this settings

export LS_HOME=/usr/share/logstash
export LOGSTASH_CORE=/usr/share/logstash/logstash-core
export PATH=$PATH:$LS_HOME/bin
export GEM_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export GEM_PATH=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export MY_RUBY_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0
export PATH=$PATH:/usr/share/logstash/vendor/jruby/bin
export JAVA_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
export PATH=$PATH:$JAVA_HOME/bin

[admin@rh9v ~]$ logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2025-07-06 00:11:07.577 [main] runner - The use of JAVA_HOME has been deprecated. Logstash 8.0 and later ignores JAVA_HOME and uses the bundled JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK (organizational-specific compliance requirements, for example), you can configure LS_JAVA_HOME to use that version instead.
[INFO ] 2025-07-06 00:11:07.585 [main] runner - Starting Logstash {"logstash.version"=>"9.0.3", "jruby.version"=>"jruby 9.4.9.0 (3.1.4) 2024-11-04 547c6b150e OpenJDK 64-Bit Server VM 21.0.7+6-LTS on 21.0.7+6-LTS +indy +jit [x86_64-linux]"}
[INFO ] 2025-07-06 00:11:07.589 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11]
[INFO ] 2025-07-06 00:11:07.814 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-string-length configured to 200000000 (logstash default)
[INFO ] 2025-07-06 00:11:07.815 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-number-length configured to 10000 (logstash default)
[INFO ] 2025-07-06 00:11:07.816 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-nesting-depth configured to 1000 (logstash default)
Your settings are invalid. Reason: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.
[FATAL] 2025-07-06 00:11:07.836 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[admin@rh9v ~]$

Then changed /etc/logstash/logstash.yml

------------ Other Settings --------------

Allow or block running Logstash as superuser (default: true). Windows are excluded from the checking

allow_superuser: false

Where to find custom plugins

path.plugins:

and run as root using the env.sh file
export LS_HOME=/usr/share/logstash
export LOGSTASH_CORE=/usr/share/logstash/logstash-core
export PATH=$PATH:$LS_HOME/bin
export GEM_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export GEM_PATH=/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems
export MY_RUBY_HOME=/usr/share/logstash/vendor/bundle/jruby/3.1.0
export PATH=$PATH:/usr/share/logstash/vendor/jruby/bin
export JAVA_HOME=/usr/lib/jvm/jdk-11.0.26-oracle-x64
export PATH=$PATH:$JAVA_HOME/bin

[root@rh9v admin]# . ./env.sh
[root@rh9v admin]# logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[FATAL] 2025-07-06 00:14:50.317 [main] runner - An unexpected error occurred! {:error=>#<RuntimeError: Logstash cannot be run as superuser.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/runner.rb:430:in running_as_superuser'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:259:in execute'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:66:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:249:in run'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/clamp-1.3.2/lib/clamp/command.rb:140:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:89:in '"]}
[FATAL] 2025-07-06 00:14:50.330 [main] Logstash - Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
[root@rh9v admin]#

10

You should change ownership:
chown -R logstash:logstash /usr/share/logstash/data

Run LS as a service.Normally, data should be in /var/lib/logstash

11

Logstash will be installed as a service if installed correctly from rpm on RHEL9, it would also create a logstash user to run as.

Any specific reason you are using that JDK rather than the JVM shipped with logstash ?

But your last post was difficult to read/parse due to formatting, but you seemed to again repeat error of running as root.

Here's my RHEL10 system, but RHEL9 is the same:

[kevin@rhel10x1 ~]$ systemctl status logstash | cat
â—Ź logstash.service - logstash
     Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: disabled)
     Active: active (running) since Sun 2025-07-06 13:08:05 UTC; 6s ago
 Invocation: 7b50130cd88d47059eac6167d7fb3ea6
   Main PID: 90914 (java)
      Tasks: 21 (limit: 16412)
     Memory: 333.5M (peak: 334.9M)
        CPU: 11.226s
     CGroup: /system.slice/logstash.service
             └─90914 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Dlog4j2.isThreadContextMapInheritable=true -Djruby.regexp.interruptible=true -Djdk.io.File.enableADS=true --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio.channels=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/sun.management=ALL-UNNAMED -Dio.netty.allocator.maxOrder=11 -cp /usr/share/logstash/vendor/jruby/lib/jruby.jar:/usr/share/logstash/logstash-core/lib/jars/checker-qual-3.42.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.17.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-logging-1.3.1.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.26.1.jar:/usr/share/logstash/logstash-core/lib/jars/failureaccess-1.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.22.0.jar:/usr/share/logstash/logstash-core/lib/jars/guava-33.1.0-jre.jar:/usr/share/logstash/logstash-core/lib/jars/httpclient-4.5.14.jar:/usr/share/logstash/logstash-core/lib/jars/httpcore-4.4.16.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/javassist-3.30.2-GA.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-3.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/jvm-options-parser-9.0.3.jar:/usr/share/logstash/logstash-core/lib/jars/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-jcl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/reflections-0.10.2.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.32.jar:/usr/share/logstash/logstash-core/lib/jars/snakeyaml-2.2.jar org.logstash.Logstash --path.settings /etc/logstash

Jul 06 13:08:05 rhel10x1 systemd[1]: Started logstash.service - logstash.
Jul 06 13:08:05 rhel10x1 logstash[90914]: Using bundled JDK: /usr/share/logstash/jdk
[kevin@rhel10x1 ~]$ ps -ulogstash
    PID TTY          TIME CMD
  90914 ?        00:00:25 java
12

Hi, I reviewed the JDK of the logstash 9.0 and found that uses temurin JDK 21. Because i has many javas java --version still pointed to java 11. So i downloaded and installed temurin JDK 21, and launched with a user after give some permissions to directories.

Tested first on RH9, but still found problems so i decided to install and test with RH 8 and finally worked.

Thanks for all your help and suggestions

[admin@rh8v java]$ logstash --enable-local-plugin-development -e 'input { stdin { } } output { stdout { } }'
Using bundled JDK: /usr/share/logstash/jdk
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2025-07-06 13:28:02.278 [main] runner - The use of JAVA_HOME has been deprecated. Logstash 8.0 and later ignores JAVA_HOME and uses the bundled JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK (organizational-specific compliance requirements, for example), you can configure LS_JAVA_HOME to use that version instead.
[INFO ] 2025-07-06 13:28:02.285 [main] runner - Starting Logstash {"logstash.version"=>"9.0.3", "jruby.version"=>"jruby 9.4.9.0 (3.1.4) 2024-11-04 547c6b150e OpenJDK 64-Bit Server VM 21.0.7+6-LTS on 21.0.7+6-LTS +indy +jit [x86_64-linux]"}
[INFO ] 2025-07-06 13:28:02.289 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11]
[INFO ] 2025-07-06 13:28:02.518 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-string-length configured to 200000000 (logstash default)
[INFO ] 2025-07-06 13:28:02.519 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-number-length configured to 10000 (logstash default)
[INFO ] 2025-07-06 13:28:02.519 [main] StreamReadConstraintsUtil - Jackson default value override logstash.jackson.stream-read-constraints.max-nesting-depth configured to 1000 (logstash default)
[WARN ] 2025-07-06 13:28:02.767 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because command line options are specified
[INFO ] 2025-07-06 13:28:03.662 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[INFO ] 2025-07-06 13:28:03.840 [Converge PipelineAction::Create] Reflections - Reflections took 161 ms to scan 1 urls, producing 149 keys and 521 values
[INFO ] 2025-07-06 13:28:04.113 [Converge PipelineAction::Create] javapipeline - Pipeline main is configured with pipeline.ecs_compatibility: v8 setting. All plugins in this pipeline will default to ecs_compatibility => v8 unless explicitly configured otherwise.
[INFO ] 2025-07-06 13:28:04.168 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["config string"], :thread=>"#<Thread:0x1027cb9a /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:138 run>"}
[INFO ] 2025-07-06 13:28:04.976 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>0.81}
[INFO ] 2025-07-06 13:28:05.016 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
The stdin plugin is now waiting for input:
[INFO ] 2025-07-06 13:28:05.037 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
hello world
{
"message" => "hello world",
"@version" => "1",
"@timestamp" => 2025-07-06T19:28:41.781834673Z,
"event" => {
"original" => "hello world"
},
"host" => {
"hostname" => "rh8v.lab"
}
}

1 Like