# Specifie error logged in logstash-plain.log

**URL:** <https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473>\
**Category:** Logstash\
**Created:** [August 29, 2018, 6:48am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473 "2018-08-29T06:48:54Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![wonki](https://avatars.discourse-cdn.com/v4/letter/w/aeb1de/32.png) [@wonki](https://discuss.elastic.co/u/wonki)\
**Post date:** [August 29, 2018, 6:48am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/1 "2018-08-29T06:48:54Z")

</div>

I thought my elastic stack runs well,  
but in logstash-plain.log file, the below error logged repeatebly.  
Is it the normal situation?? Again, there is no problem to fetch log data indexed in elasticsearch using filebeat, logstash. Am i missed something?

[2018-08-28T00:00:40,244][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit  
[2018-08-28T00:01:07,760][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Path "/var/lib/logstash/queue" must be a writable directory. It is not writable.\>, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:448:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:230:in`validate\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:141:in `block in validate_all'", "org/jruby/RubyHash.java:1343:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:140:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:279:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:238:in`run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in`'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 29, 2018, 9:30am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/2 "2018-08-29T09:30:53Z")

</div>

> Path "/var/lib/logstash/queue" must be a writable directory. It is not writable.

That directory needs to be writable by the user that runs Logstash.

---

<div class="post-metadata">

**Author:** ![wonki](https://avatars.discourse-cdn.com/v4/letter/w/aeb1de/32.png) [@wonki](https://discuss.elastic.co/u/wonki)\
**Post date:** [August 30, 2018, 4:02am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/3 "2018-08-30T04:02:52Z")

</div>

/var/lib/logstash/queue directory's permission is 'drwxr-xr-x'. I have thought this means that user have write permission about this directory. Is is wrong? Do i have to do something else to fix that error?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 30, 2018, 5:52am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/4 "2018-08-30T05:52:59Z")

</div>

What user owns that directory and what user does Logstash run as?

---

<div class="post-metadata">

**Author:** ![wonki](https://avatars.discourse-cdn.com/v4/letter/w/aeb1de/32.png) [@wonki](https://discuss.elastic.co/u/wonki)\
**Post date:** [August 30, 2018, 5:53am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/5 "2018-08-30T05:53:44Z")

</div>

root owns queue directory and root run logstash

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 30, 2018, 5:56am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/6 "2018-08-30T05:56:13Z")

</div>

How did you configure so that root runs Logstash? Have you verified that it actually _is_ running as root?

(Running Logstash as root is not recommended.)

---

<div class="post-metadata">

**Author:** ![wonki](https://avatars.discourse-cdn.com/v4/letter/w/aeb1de/32.png) [@wonki](https://discuss.elastic.co/u/wonki)\
**Post date:** [August 30, 2018, 6:03am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/7 "2018-08-30T06:03:01Z")

</div>

Thanks for your rapid reply.  
[root@chef\_node1 ~]# \<- i thought i was running as root because of sign in left. Is it wrong..?  
And in your opinion, make root owns queue and change permission like rwxrwxrwx and run logstash in my account. right? then, the issue i said will disappeared right??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 30, 2018, 6:09am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/8 "2018-08-30T06:09:39Z")

</div>

> [root@chef\_node1 ~]# \<- i thought i was running as root because of sign in left. Is it wrong..?

It depends on how you're starting Logstash.

---

<div class="post-metadata">

**Author:** ![wonki](https://avatars.discourse-cdn.com/v4/letter/w/aeb1de/32.png) [@wonki](https://discuss.elastic.co/u/wonki)\
**Post date:** [August 30, 2018, 6:23am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/9 "2018-08-30T06:23:46Z")

</div>

I just run

in /usr/share/logstash

[root@chef\_node1 ~] bin/logstash -f /etc/logstash/conf.d/logstash.conf

like this way

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 30, 2018, 6:39am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/10 "2018-08-30T06:39:12Z")

</div>

Okay, then you're definitely running it as root. Then I don't know what's going on.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 6:39am UTC](https://discuss.elastic.co/t/specifie-error-logged-in-logstash-plain-log/146473/11 "2018-09-27T06:39:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.