Test run fails

Elastic Stack Logstash
#1

Hi,
I have Logstash (on a seperate server to ES) set to run as a service, but wanted to test it first by running
\bin\logstash.bat -f .\config\logstash-conf.conf
However when I run this it appears to start but then stop, is this normal behaviour:

PS D:\Logstash\logstash-7.9.2\bin> .\logstash.bat -f .\config\Logstash-conf.conf
Sending Logstash logs to D:/Logstash/logstash-7.9.2/logs which is now configured via log4j2.properties
[2020-10-01T15:58:11,353][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) Client VM 25.261-b12 on 1.8.0_261-b12 +indy +jit [mswin32-i386]"}
[2020-10-01T15:58:11,556][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-10-01T15:58:11,962][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"D:/Logstash/logstash-7.9.2/bin/config/Logstash-conf.conf"}
[2020-10-01T15:58:11,962][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2020-10-01T15:58:12,181][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2020-10-01T15:58:17,329][INFO ][logstash.runner          ] Logstash shut down.
[2020-10-01T15:58:17,361][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

If I start the service it runs and stays running, so thought it should be OK.
The conf file contents are (I have not yet set up Beats on another server to push logs to LS):

# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => "10.103.186.210:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}
#2

It seems highly unlikely that logstash would look for that file if you started it with

\bin\logstash.bat -f .\config\logstash-conf.conf
#3

Ah yep, corrected that, now got a new error:

[2020-10-01T16:28:22,559][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused: connect"}
[2020-10-01T16:28:23,372][WARN ][logstash.runner          ] SIGINT received. Shutting down.
#4

Is elasticsearch listening on localhost?

#5

Crap, sorry, forgot to mention ES is on another server... I can't see where and what file I need to tell LS to look at for the ES server. Not easily searchable online

#6

That is how you tell logstash where to connect to. I cannot explain why it would be connecting to localhost if you actually have that in your configuration.

#7

Ah interesting, I just started the service to see what the LS log file would state, as when running it via CLI it had lots of errors about connecting to localhost for ES as well. When running it as a service, it sees the correct IP address according to the conf file

#8

Found the issue, was due to the elastic YML file not having network.host: 0.0.0.0 being set which wasn't working due to some further missing config in the YML file which allowed the service to start:

discovery.seed_hosts: []
discovery.type: single-node