Server 2016 Logstash 7.7 continually stops and restarts with errors

Elastic Stack Logstash
1

Here is error in the log file:
[2020-06-01T00:04:16,445][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.7.0"}
[2020-06-01T00:04:16,986][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"c:/elk/logstash/bin/config.json"}
[2020-06-01T00:04:17,032][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2020-06-01T00:04:17,329][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-06-01T00:04:17,494][INFO ][logstash.runner ] Logstash shut down.
[2020-06-01T00:04:44,651][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

The messages error messages above continuously repeat and fill up the disk drive at location C:\Windows\Temp\

I'm pretty sure there is a simple fix, but I'm a new ELK user. Help?

2

You have set path.config (either in logstash.yml or on the command line using -f) to "c:/elk/logstash/bin/config.json". logstash is not finding a configuration in that file, so it shuts down.

3

I uninstalled and re-installed logstash on Server 2016 DataCenter edition using the NSSM and renamed the sample-logstash.conf file and the argument -f C:\ELK\logstash\config\logstash.conf and renamed the sample logstash.conf file to logstash.conf.

Then Java started tearing up my processor:
image
and new jruby folders were created every 15 to 30 seconds filling up the Windows\Temp directory.

image
image804×329 25.7 KB

and When I stopped the logstash service, my CPU utilization drops to normal.
The logstash log file repeats the following message:
[2020-06-04T06:45:57,178][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.7.0"} [2020-06-04T06:45:58,427][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 3, column 1 (byte 59) after ", :backtrace=>["C:/ELK/logstash/logstash-core/lib/logstash/compiler.rb:58:in compile_imperative'", "C:/ELK/logstash/logstash-core/lib/logstash/compiler.rb:66:in compile_graph'", "C:/ELK/logstash/logstash-core/lib/logstash/compiler.rb:28:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "C:/ELK/logstash/logstash-core/lib/logstash/compiler.rb:27:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in initialize'", "C:/ELK/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in initialize'", "C:/ELK/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "C:/ELK/logstash/logstash-core/lib/logstash/agent.rb:342:in block in converge_state'"]}

Then, I simplified by logstash.conf file to have only two lines:
`input {
beats {
port => 5044
type => "log"
}
}

output {
elasticsearch {
hosts => "localhost:9200" `

No more jruby folders filling up the temp drive, processor operating at normal, and no more errors in the log.

Thank you -

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.