When I launch logstash on Windows with the config file below, the pipeline is created, the data are send to elasticsearch but the pipeline stopped few seconds after.
I ran it in the verbose mod et I have only the end of the terminal logs.
at C_3a_.Users.upetit.Downloads.logstash_minus_5_dot_3_dot_1.lib.bootstr
ap.environment.load(C:\Users\upetit\Downloads\logstash-5.3.1\lib\bootstrap\envir
onment.rb)
at org.jruby.Ruby.runScript(Ruby.java:857)
at org.jruby.Ruby.runScript(Ruby.java:850)
at org.jruby.Ruby.runNormally(Ruby.java:729)
at org.jruby.Ruby.runFromMain(Ruby.java:578)
at org.jruby.Main.doRunFromMain(Main.java:393)
at org.jruby.Main.internalRun(Main.java:288)
at org.jruby.Main.run(Main.java:217)
at org.jruby.Main.main(Main.java:197)
Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.l
og4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@80fd11b]
unable to create manager for [${sys:ls.logs}/logstash-slowlog-${sys:ls.log.form
at}.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileMa
nager$FactoryData@37b68042[pattern=${sys:ls.logs}/logstash-slowlog-${sys:ls.log.
format}-%d{yyyy-MM-dd}.log, append=true, bufferedIO=true, bufferSize=8192, polic
y=CompositeTriggeringPolicy(policies=[TimeBasedTriggeringPolicy(nextRolloverMill
is=0, interval=1, modulate=true)]), strategy=DefaultRolloverStrategy(min=1, max=
7), advertiseURI=null, layout=org.apache.logging.log4j.core.layout.JsonLayout@3e
79490]]
at org.apache.logging.log4j.core.appender.AbstractManager.getManager(Abs
tractManager.java:75)
at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager
(OutputStreamManager.java:81)
at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.get
FileManager(RollingFileManager.java:103)
at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppe
nder(RollingFileAppender.java:191)
... 139 more
2017-05-04 14:17:52,737 main ERROR Null object returned for RollingFile in Appen
ders.
2017-05-04 14:17:52,738 main ERROR Null object returned for RollingFile in Appen
ders.
2017-05-04 14:17:52,739 main ERROR Null object returned for RollingFile in Appen
ders.
2017-05-04 14:17:52,742 main ERROR Null object returned for RollingFile in Appen
ders.
2017-05-04 14:17:52,746 main ERROR Unable to locate appender "${sys:ls.log.forma
t}_console" for logger config "root"
2017-05-04 14:17:52,748 main ERROR Unable to locate appender "${sys:ls.log.forma
t}_rolling" for logger config "root"
2017-05-04 14:17:52,749 main ERROR Unable to locate appender "${sys:ls.log.forma
t}_rolling_slowlog" for logger config "slowlog"
2017-05-04 14:17:52,750 main ERROR Unable to locate appender "${sys:ls.log.forma
t}_console_slowlog" for logger config "slowlog"
Based in the info in this Github issue thread I would say you have a file permission issue - Logstash can't write to the folder that is configured to receive logs.
Thanks for you answer.
This is weird because I am Administrator on my Windows machine. It shouldn't happen any of these permission problems...
My logstash.yml (I kept every lines commented as default):
# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
# pipeline:
# batch:
# size: 125
# delay: 5
#
# Or as flat keys:
#
# pipeline.batch.size: 125
# pipeline.batch.delay: 5
#
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
# node.name: test
#
# If omitted the node name will default to the machine's host name
#
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#
# path.data:
#
# ------------ Pipeline Settings --------------
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
# pipeline.workers: 2
#
# How many workers should be used per output plugin instance
#
# pipeline.output.workers: 1
#
# How many events to retrieve from inputs before sending to filters+workers
#
# pipeline.batch.size: 125
#
# How long to wait before dispatching an undersized batch to filters+workers
# Value is in milliseconds.
#
# pipeline.batch.delay: 5
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
#
# ------------ Pipeline Configuration Settings --------------
#
# Where to fetch the pipeline configuration for the main pipeline
#
# path.config:
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
# At startup, test if the configuration is valid and exit (dry run)
#
# config.test_and_exit: false
#
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
# config.reload.automatic: false
#
# How often to check if the pipeline configuration has changed (in seconds)
#
# config.reload.interval: 3
#
# Show fully compiled configuration as debug log message
# NOTE: --log.level must be 'debug'
#
# config.debug: false
#
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
# "persisted" for disk-based acked queueing. Defaults is memory
#
# queue.type: memory
#
# If using queue.type: persisted, the directory path where the data files will be stored.
# Default is path.data/queue
#
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
# append-only data files separated into pages. Default is 250mb
#
# queue.page_capacity: 250mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
# Default is 0 (unlimited)
#
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
# If you would like more unacked events to be buffered in Logstash, you can increase the
# capacity using this setting. Please make sure your disk drive has capacity greater than
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
# whichever criteria is reached first
# Default is 1024mb or 1gb
#
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
# Default is 1000, 0 for no periodic checkpoint.
#
# queue.checkpoint.interval: 1000
#
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
# http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
# log.level: info
# path.logs:
#
# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.