Run logstash as service giving error

Elastic Stack Logstash
1

Hi All,

I am able to run logstash as command line , but when I try to run it as a services . It is getting restarted after every 6 seconds and no data is getting loaded to elasticsearch

I have placed my conf file in etc/logstash/conf.d folder
with datapower.conf name

I am getting below error :
Logstash - java.lang.IllegalStateException: Logstash stopp...dev/null

2

Hi All,

I am new to ELK stack and got stuck with running logstash as a service.

Logstash is working fine using ./logstash command from below path

/usr/share/logstash/bin

However it is not working with systemctl start logstash . Can anyone please help on this.

1 Like
3

post any log messages you are having

4

@elasticforme :

I can see below error while checking status

[root@ndc3vmappelk01 ~]# systemctl status logstash -l
â—Ź logstash.service - logstash

  • Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)*
  • Active: activating (auto-restart) (Result: exit-code) since Fri 2020-07-10 19:32:34 IST; 2ms ago*
  • Process: 104656 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE)*
  • Main PID: 104656 (code=exited, status=1/FAILURE)*

Jul 10 19:32:34 IP systemd[1]: Unit logstash.service entered failed state.
Jul 10 19:32:34 IP systemd[1]: logstash.service failed.

Actually, it keeps on restarting and I can see permission denied sometimes

When I check the status after stopping the service. I can see below details

[root@IP bin]# systemctl status logstash -l
â—Ź logstash.service - logstash

  • Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)*
  • Active: inactive (dead)*

Jul 10 19:58:53 IP systemd[1]: Unit logstash.service entered failed state.
Jul 10 19:58:53 IP systemd[1]: logstash.service failed.
Jul 10 19:58:53 IP systemd[1]: logstash.service holdoff time over, scheduling restart.
Jul 10 19:58:53 IP systemd[1]: Stopped logstash.
Jul 10 19:58:53 IP systemd[1]: Started logstash.
Jul 10 19:59:01 IP logstash[114314]: [ERROR] 2020-07-10 19:59:00.998 [main] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (EACCES) Permission denied - /dev/null
Jul 10 19:59:01 IP systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
Jul 10 19:59:01 IP systemd[1]: Unit logstash.service entered failed state.
Jul 10 19:59:01 IP systemd[1]: logstash.service failed.
Jul 10 19:59:01 IP systemd[1]: Stopped logstash.
[root@IP bin]#

5

is this the same error in your log file? if you have not change log file then it will be in /var/log/logstash

6

looks like you’re using /dev/null somewhere in your config(maybe your pipeline?). if you run logstash cli as root, root will have access to /dev/null , but logstash from systemctl by default will be run as logstash user, and it doesn’t have write access to /dev/null

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.