Unnable to start Logstash correctly

Elastic Stack Logstash
1

I´m trying to connect Logstash with Filebeat in Centos 7 and this is the error that occurs:

This is the command I´m using: bin/logstash -f logstash-sample.conf --config.reload.automatic

OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.9.0.jar) to method sun.nio.ch.NativeThread.signal(long)
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2020-02-28 12:08:44.197 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2020-02-28 12:08:44.217 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.6.0"}
[INFO ] 2020-02-28 12:08:47.409 [Converge PipelineAction::Create] Reflections - Reflections took 59 ms to scan 1 urls, producing 20 keys and 40 values
[WARN ] 2020-02-28 12:08:48.522 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[INFO ] 2020-02-28 12:08:48.530 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/usr/share/logstash/logstash-sample.conf"], :thread=>"#<Thread:0x141d368 run>"}
[INFO ] 2020-02-28 12:08:50.815 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[INFO ] 2020-02-28 12:08:50.840 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[INFO ] 2020-02-28 12:08:50.996 [[main]<beats] Server - Starting server on port: 5044
[INFO ] 2020-02-28 12:08:51.035 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>}
[INFO ] 2020-02-28 12:08:51.515 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9601}
[ERROR] 2020-02-28 12:08:57.476 [[main]<beats] javapipeline - A plugin had an unrecoverable error. Will restart this plugin.
Pipeline_id:main
Plugin: <LogStash::Inputs::Beats port=>5044, id=>"2548e43fb575d656d59bc1b63b141eee39601f6750ba6969c1c42131284f5736", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_5dd2082f-740b-4943-83ef-564c5bf9dd12", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, add_hostname=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>4>
Error: Address already in use
Exception: Java::JavaNet::BindException
Stack: sun.nio.ch.Net.bind0(Native Method)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:455)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:447)
sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:227)
io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:130)
io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:558)
io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1358)
io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:501)
io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:486)
io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:1019)
io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:254)
io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:366)
io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:163)
io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:404)
io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:462)
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:897)
io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30)
java.lang.Thread.run(java/lang/Thread.java:834)
[INFO ] 2020-02-28 12:08:58.518 [[main]<beats] Server - Starting server on port: 5044
[ERROR] 2020-02-28 12:09:04.779 [[main]<beats] javapipeline - A plugin had an unrecoverable error. Will restart this plugin.

2

You don't need to specify the option --config.reload.automatic

3

Hi Ahmed, first of all thanks for your quick reply.

I've just try without the --config.reload.automatic and the same error still happen.

Should I specify something in the pipeline.yml or in the logstash.yml before i run this command?

Thanks

4

By default no. But you must define your input / output in the file to which you call from the command with the -f option which is logstasf-sample.conf

5

Yeah, i'm doing that. I'm following the elastic documentation: https://www.elastic.co/guide/en/logstash/7.x/advanced-pipeline.html#CO1-1

6

can you show us the contents of the file: logstash-sample.conf ?

7

Something is already listening on port 5044, so your beat input cannot use it.

1 Like
8

input {
beats {
port => 5044
}
}

#filter {

#}

output {
stdout {codec => rubydebug}
#elasticsearch {
#hosts => ["localhost:9200"]
#index => "%{[@metadata][beat]}-%{[@metadata][version]}"
#user => "elastic"
#password => "changeme"
#}
}

9

@Badger And what are the opctions?

10

@Badger @ahmed_charafouddine @magnusbaeck @Christian_Dahlqvist

After searching a lot, I've tried another command: bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/logstash-sample.conf

And reports another error:

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2020-03-02T12:40:25,269][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-03-02T12:40:25,792][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.6.0"}
[2020-03-02T12:40:30,258][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "=>" at line 22, column 11 (byte 385) after output {\n #stdout {codec => rubydebug}\n elasticsearch {\n hosts => ["http://localhost:9200"]\n index => "%{[@metadata][beat]}-%{[@metadata][version]}"\n #user => "elastic"\n #password => "changeme"\n #}\n stdout ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in block in compile_sources'", "org/jruby/RubyArray.java:2580:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:14:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"]}

Can someone help me, please?
Thanks a lot!

11

The port 5044 is already in use by another process (check with something like lsof -i :5044) — a port can only be used by one process. Maybe you already have another instance of Logstash running.

PS: Please format your code for better readability and to keep the indentation.

12

I've just tried this command and the port 5044 is not listening.
Can you please look this code and tell me if you see anything wrong, please?

Command:

bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/logstash-sample.conf

And reports another error:

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2020-03-02T12:40:25,269][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-03-02T12:40:25,792][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.6.0"}
[2020-03-02T12:40:30,258][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "=>" at line 22, column 11 (byte 385) after output {\n #stdout {codec => rubydebug}\n elasticsearch {\n hosts => ["[http://localhost:9200](http://localhost:9200/)"]\n index => "%{[@metadata][beat]}-%{[@metadata][version]}"\n #user => "elastic"\n #password => "changeme"\n #}\n stdout ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in  `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in ` compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in  `block in compile_sources'", "org/jruby/RubyArray.java:2580:in ` map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:14:in  `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in ` initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in  `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in ` initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in  `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in ` block in converge_state'"]}
13

This is a different / new error. What's on line 22 (or maybe the one before) of your config that could cause that error?

14

can you try to start logstash with this :

output{
    stdout {}
}
15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.