Unable to start Logstash docker 8.5.0

Elastic Stack Logstash
1

Hi everyone,

I'm trying to start my logstash docker after hours configuring jvm.options, log4j2.properties, logstash.yml and pipelines.yml it's still showing "Logstash shut down" , I'm running the latest version of Elasticsearch and logstash.

Below the logs:

{"log":"2022/11/14 00:46:12 Setting 'http.host' from environment.\n","stream":"stderr","time":"2022-11-14T00:46:12.886759521Z"}
{"log":"2022/11/14 00:46:12 Setting 'xpack.monitoring.elasticsearch.password' from environment.\n","stream":"stderr","time":"2022-11-14T00:46:12.886785291Z"}
{"log":"2022/11/14 00:46:12 Setting 'xpack.monitoring.enabled' from environment.\n","stream":"stderr","time":"2022-11-14T00:46:12.886795701Z"}
{"log":"2022/11/14 00:46:12 Setting 'xpack.monitoring.elasticsearch.username' from environment.\n","stream":"stderr","time":"2022-11-14T00:46:12.886826262Z"}
{"log":"2022/11/14 00:46:12 Setting 'xpack.monitoring.elasticsearch.hosts' from environment.\n","stream":"stderr","time":"2022-11-14T00:46:12.886868512Z"}
{"log":"Using bundled JDK: /usr/share/logstash/jdk\n","stream":"stdout","time":"2022-11-14T00:46:12.996963692Z"}
{"log":"Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties\n","stream":"stdout","time":"2022-11-14T00:46:32.353801331Z"}
{"log":"[2022-11-13T21:46:32,406][INFO ][logstash.runner          ] Log4j configuration path used is: /usr/share/logstash/config/log4j2.properties\n","stream":"stdout","time":"2022-11-14T00:46:32.407040017Z"}
{"log":"[2022-11-13T21:46:32,408][INFO ][logstash.runner          ] Starting Logstash {\"logstash.version\"=\u003e\"8.5.0\", \"jruby.version\"=\u003e\"jruby 9.3.8.0 (2.6.8) 2022-09-13 98d69c9461 OpenJDK 64-Bit Server VM 17.0.4+8 on 17.0.4+8 +jit [x86_64-linux]\"}\n","stream":"stdout","time":"2022-11-14T00:46:32.409286924Z"}
{"log":"[2022-11-13T21:46:32,410][INFO ][logstash.runner          ] JVM bootstrap flags: [-XX:+UseG1GC, -Djava.io.tmpdir=${ES_TMPDIR}, -XX:+HeapDumpOnOutOfMemoryError, -XX:+ExitOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Dls.cgroup.cpuacct.path.override=/, -Dls.cgroup.cpu.path.override=/, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]\n","stream":"stdout","time":"2022-11-14T00:46:32.410206861Z"}
{"log":"[2022-11-13T21:46:32,412][INFO ][logstash.settings        ] Creating directory {:setting=\u003e\"path.queue\", :path=\u003e\"/usr/share/logstash/data/queue\"}\n","stream":"stdout","time":"2022-11-14T00:46:32.412911502Z"}
{"log":"[2022-11-13T21:46:32,413][INFO ][logstash.settings        ] Creating directory {:setting=\u003e\"path.dead_letter_queue\", :path=\u003e\"/usr/share/logstash/data/dead_letter_queue\"}\n","stream":"stdout","time":"2022-11-14T00:46:32.413584637Z"}
{"log":"[2022-11-13T21:46:32,623][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=\u003e\"c10ed85c-1984-4843-a9f3-52291c671af2\", :path=\u003e\"/usr/share/logstash/data/uuid\"}\n","stream":"stdout","time":"2022-11-14T00:46:32.623368637Z"}
{"log":"[2022-11-13T21:46:34,023][INFO ][logstash.monitoring.internalpipelinesource] Monitoring License OK\n","stream":"stdout","time":"2022-11-14T00:46:34.023772326Z"}
{"log":"[2022-11-13T21:46:34,023][INFO ][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline.\n","stream":"stdout","time":"2022-11-14T00:46:34.023917057Z"}
{"log":"[2022-11-13T21:46:34,071][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=\u003e9600, :ssl_enabled=\u003efalse}\n","stream":"stdout","time":"2022-11-14T00:46:34.072432746Z"}
{"log":"[2022-11-13T21:46:34,494][INFO ][org.reflections.Reflections] Reflections took 300 ms to scan 1 urls, producing 125 keys and 438 values\n","stream":"stdout","time":"2022-11-14T00:46:34.49517105Z"}
{"log":"[2022-11-13T21:46:34,544][INFO ][logstash.javapipeline    ] Pipeline `.monitoring-logstash` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility =\u003e v8` unless explicitly configured otherwise.\n","stream":"stdout","time":"2022-11-14T00:46:34.544233154Z"}
{"log":"[2022-11-13T21:46:34,549][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] New Elasticsearch output {:class=\u003e\"LogStash::Outputs::ElasticSearchMonitoring\", :hosts=\u003e[\"http://192.168.22.31:9200\"]}\n","stream":"stdout","time":"2022-11-14T00:46:34.550005408Z"}
{"log":"[2022-11-13T21:46:34,552][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Elasticsearch pool URLs updated {:changes=\u003e{:removed=\u003e[], :added=\u003e[http://logstash_system:xxxxxx@192.168.22.31:9200/]}}\n","stream":"stdout","time":"2022-11-14T00:46:34.553152132Z"}
{"log":"[2022-11-13T21:46:34,591][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Restored connection to ES instance {:url=\u003e\"http://logstash_system:xxxxxx@192.168.22.31:9200/\"}\n","stream":"stdout","time":"2022-11-14T00:46:34.591294353Z"}
{"log":"[2022-11-13T21:46:34,595][INFO ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Elasticsearch version determined (8.5.0) {:es_version=\u003e8}\n","stream":"stdout","time":"2022-11-14T00:46:34.595345794Z"}
{"log":"[2022-11-13T21:46:34,595][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=\u003e8}\n","stream":"stdout","time":"2022-11-14T00:46:34.595601076Z"}
{"log":"[2022-11-13T21:46:34,600][WARN ][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Elasticsearch Output configured with `ecs_compatibility =\u003e v8`, which resolved to an UNRELEASED preview of version 8.0.0 of the Elastic Common Schema. Once ECS v8 and an updated release of this plugin are publicly available, you will need to update this plugin to resolve this warning.\n","stream":"stdout","time":"2022-11-14T00:46:34.600992347Z"}
{"log":"[2022-11-13T21:46:34,601][WARN ][logstash.javapipeline    ][.monitoring-logstash] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary\n","stream":"stdout","time":"2022-11-14T00:46:34.60136148Z"}
{"log":"[2022-11-13T21:46:34,607][INFO ][logstash.javapipeline    ][.monitoring-logstash] Starting pipeline {:pipeline_id=\u003e\".monitoring-logstash\", \"pipeline.workers\"=\u003e1, \"pipeline.batch.size\"=\u003e2, \"pipeline.batch.delay\"=\u003e5, \"pipeline.max_inflight\"=\u003e2, \"pipeline.sources\"=\u003e[\"monitoring pipeline\"], :thread=\u003e\"#\u003cThread:0x39930d5c@/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:131 run\u003e\"}\n","stream":"stdout","time":"2022-11-14T00:46:34.608082881Z"}
{"log":"[2022-11-13T21:46:35,198][INFO ][logstash.javapipeline    ][.monitoring-logstash] Pipeline Java execution initialization time {\"seconds\"=\u003e0.59}\n","stream":"stdout","time":"2022-11-14T00:46:35.198601214Z"}
{"log":"[2022-11-13T21:46:35,223][INFO ][logstash.javapipeline    ][.monitoring-logstash] Pipeline started {\"pipeline.id\"=\u003e\".monitoring-logstash\"}\n","stream":"stdout","time":"2022-11-14T00:46:35.224177649Z"}
{"log":"[2022-11-13T21:46:35,245][INFO ][logstash.agent           ] Pipelines running {:count=\u003e1, :running_pipelines=\u003e[:\".monitoring-logstash\"], :non_running_pipelines=\u003e[]}\n","stream":"stdout","time":"2022-11-14T00:46:35.246297658Z"}
{"log":"[2022-11-13T21:46:36,602][INFO ][logstash.javapipeline    ][.monitoring-logstash] Pipeline terminated {\"pipeline.id\"=\u003e\".monitoring-logstash\"}\n","stream":"stdout","time":"2022-11-14T00:46:36.602241368Z"}
{"log":"[2022-11-13T21:46:37,255][INFO ][logstash.pipelinesregistry] Removed pipeline from registry successfully {:pipeline_id=\u003e:\".monitoring-logstash\"}\n","stream":"stdout","time":"2022-11-14T00:46:37.255989683Z"}
{"log":"[2022-11-13T21:46:37,341][INFO ][logstash.runner          ] Logstash shut down.\n","stream":"stdout","time":"2022-11-14T00:46:37.341787837Z"}

Any help is really appreciated.

2

The pipeline shuts down 1.4 seconds after it started. What does your input configuration look like? Perhaps it finished all the work it could do.

3

Thank you for your reply, that's my piplines.yml:

 - pipeline.id: elastiflow
   pipeline.workers: 4
   pipeline.batch.size: 256
   pipeline.batch.delay: 50

that is my logstash.yml

http.host: 192.168.22.33
xpack.monitoring.elasticsearch.hosts: http://192.168.22.31:9200
xpack.monitoring.elasticsearch.password: XXXX
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.enabled: true

My goal is to integrate Elastiflow to elastic (all dockers) and for that I'll need Logstash and then install the sflow plugin.

4

I asked for the input {} section of the logstash configuration.

5

How are you starting up Logstash? Using docker compose?

Are you binding mount your local pipelines.yml ? You need to bind mount your pipelines.yml or else it will use the default pipelines.yml which point to the path /usr/share/logstash/pipeline.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.