# Problem with Logstash, don't start getting message "Exception in lumberjack input"

**URL:** <https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214>\
**Category:** Logstash\
**Created:** [June 23, 2015, 8:21pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214 "2015-06-23T20:21:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fabiotoy](https://avatars.discourse-cdn.com/v4/letter/f/e95f7d/32.png) [@fabiotoy](https://discuss.elastic.co/u/fabiotoy)\
**Post date:** [June 23, 2015, 8:21pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214/1 "2015-06-23T20:21:13Z")

</div>

Hi guys I´m having problem with logstash.  
I am using:  
elasticsearch-1.5.2-1.noarch  
logstash-1.5.1-1.noarch  
logstash-forwarder-0.4.0-1.x86\_64  
and CentOs 7x.

I have 3 files as config in logstash/conf.d/  
01-lumberjack-input.conf  
input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}  
10-syslog.conf  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}  
30-lumberjack-output.conf  
output {  
#elasticsearch { host =\> localhost =\>"logstash-%{+YYYY.MM.dd}" }  
elasticsearch { host =\> localhost }  
stdout { codec =\> rubydebug }  
}

Elasticsearch doesn't have and index of logstash.  
I found this in my logstash.log

{:timestamp=\>"2015-06-23T15:44:30.185000-0300", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn}  
{:timestamp=\>"2015-06-23T15:44:30.188000-0300", :message=\>"Exception in lumberjack input", :exception=\>#, :level=\>:error}

The keys exists in the path.  
I used configtest to test the configuration and get okay as response.

Anyone have a clue?

---

<div class="post-metadata">

**Author:** ![fabiotoy](https://avatars.discourse-cdn.com/v4/letter/f/e95f7d/32.png) [@fabiotoy](https://discuss.elastic.co/u/fabiotoy)\
**Post date:** [June 23, 2015, 8:22pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214/2 "2015-06-23T20:22:36Z")

</div>

In 30-lumberjack-output.conf  
the line  
#elasticsearch { host =\> localhost =\>"logstash-%{+YYYY.MM.dd}" }  
was marked with "#"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 24, 2015, 7:22am UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214/3 "2015-06-24T07:22:34Z")

</div>

Are those two lines really the only ones in logstash.log? What if you turn up logging with `--verbose` or even `--debug`?

---

<div class="post-metadata">

**Author:** ![fabiotoy](https://avatars.discourse-cdn.com/v4/letter/f/e95f7d/32.png) [@fabiotoy](https://discuss.elastic.co/u/fabiotoy)\
**Post date:** [June 24, 2015, 7:34pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214/4 "2015-06-24T19:34:47Z")

</div>

Hi Magnus.

Thanks for the support.  
I tried the two option. Those are the only line in logstash.log. But when i debugged or used --verbose, those error only appeared when i stopped the process.  
Logstash is not the problem, logstash-forwarder is not sending data.  
Aparentetly I had problem with key. I make some new keys and update openssl clients.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214/5 "2017-07-06T05:36:36Z")

</div>