Specifie error logged in logstash-plain.log

Elastic Stack Logstash
1

I thought my elastic stack runs well,
but in logstash-plain.log file, the below error logged repeatebly.
Is it the normal situation?? Again, there is no problem to fetch log data indexed in elasticsearch using filebeat, logstash. Am i missed something?

[2018-08-28T00:00:40,244][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2018-08-28T00:01:07,760][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<ArgumentError: Path "/var/lib/logstash/queue" must be a writable directory. It is not writable.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:448:in validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:230:invalidate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:141:in block in validate_all'", "org/jruby/RubyHash.java:1343:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:140:in validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:279:inexecute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:238:inrun'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in'"]}

2

Path "/var/lib/logstash/queue" must be a writable directory. It is not writable.

That directory needs to be writable by the user that runs Logstash.

3

/var/lib/logstash/queue directory's permission is 'drwxr-xr-x'. I have thought this means that user have write permission about this directory. Is is wrong? Do i have to do something else to fix that error?

4

What user owns that directory and what user does Logstash run as?

5

root owns queue directory and root run logstash

6

How did you configure so that root runs Logstash? Have you verified that it actually is running as root?

(Running Logstash as root is not recommended.)

7

Thanks for your rapid reply.
[root@chef_node1 ~]# <- i thought i was running as root because of sign in left. Is it wrong..?
And in your opinion, make root owns queue and change permission like rwxrwxrwx and run logstash in my account. right? then, the issue i said will disappeared right??

8

[root@chef_node1 ~]# <- i thought i was running as root because of sign in left. Is it wrong..?

It depends on how you're starting Logstash.

9

I just run

in /usr/share/logstash

[root@chef_node1 ~] bin/logstash -f /etc/logstash/conf.d/logstash.conf

like this way

10

Okay, then you're definitely running it as root. Then I don't know what's going on.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.