# Unnable to start Logstash correctly **URL:** \ **Category:** Logstash\ **Created:** [February 28, 2020, 12:16pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424 "2020-02-28T12:16:58Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [February 28, 2020, 12:16pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/1 "2020-02-28T12:16:59Z")
I´m trying to connect Logstash with Filebeat in Centos 7 and this is the error that occurs: This is the command I´m using: **bin/logstash -f logstash-sample.conf --config.reload.automatic** OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.9.0.jar) to method sun.nio.ch.NativeThread.signal(long) WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2020-02-28 12:08:44.197 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2020-02-28 12:08:44.217 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"7.6.0"} [INFO] 2020-02-28 12:08:47.409 [Converge PipelineAction::Create] Reflections - Reflections took 59 ms to scan 1 urls, producing 20 keys and 40 values [WARN] 2020-02-28 12:08:48.522 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster\_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team. [INFO] 2020-02-28 12:08:48.530 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, "pipeline.sources"=\>["/usr/share/logstash/logstash-sample.conf"], :thread=\>"#\"} [INFO] 2020-02-28 12:08:50.815 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} [INFO] 2020-02-28 12:08:50.840 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"} [INFO] 2020-02-28 12:08:50.996 [[main]\1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [INFO] 2020-02-28 12:08:51.515 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9601} [ERROR] 2020-02-28 12:08:57.476 [[main]\5044, id=\>"2548e43fb575d656d59bc1b63b141eee39601f6750ba6969c1c42131284f5736", enable\_metric=\>true, codec=\>\"plain\_5dd2082f-740b-4943-83ef-564c5bf9dd12", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, add\_hostname=\>false, ssl\_verify\_mode=\>"none", ssl\_peer\_metadata=\>false, include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60, executor\_threads=\>4\> Error: Address already in use Exception: Java::JavaNet::BindException Stack: sun.nio.ch.Net.bind0(Native Method) sun.nio.ch.Net.bind(sun/nio/ch/Net.java:455) sun.nio.ch.Net.bind(sun/nio/ch/Net.java:447) sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:227) io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:130) io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:558) io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1358) io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:501) io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:486) io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:1019) io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:254) io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:366) io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:163) io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:404) io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:462) io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:897) io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30) java.lang.Thread.run(java/lang/Thread.java:834) [INFO] 2020-02-28 12:08:58.518 [[main]\ **Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Post date:** [February 28, 2020, 12:19pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/2 "2020-02-28T12:19:44Z") You don't need to specify the option `--config.reload.automatic` ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [February 28, 2020, 12:25pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/3 "2020-02-28T12:25:07Z")
Hi Ahmed, first of all thanks for your quick reply. I've just try without the --config.reload.automatic and the same error still happen. Should I specify something in the pipeline.yml or in the logstash.yml before i run this command? Thanks ---
**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Post date:** [February 28, 2020, 12:35pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/4 "2020-02-28T12:35:24Z")
By default no. But you must define your input / output in the file to which you call from the command with the -f option which is logstasf-sample.conf ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [February 28, 2020, 12:41pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/5 "2020-02-28T12:41:19Z")
Yeah, i'm doing that. I'm following the elastic documentation: [https://www.elastic.co/guide/en/logstash/7.x/advanced-pipeline.html#CO1-1](https://www.elastic.co/guide/en/logstash/7.x/advanced-pipeline.html#CO1-1) ---
**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Post date:** [February 28, 2020, 12:42pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/6 "2020-02-28T12:42:46Z")
can you show us the contents of the file: logstash-sample.conf ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 28, 2020, 5:22pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/7 "2020-02-28T17:22:46Z")
> [@Pablo95](#): > > Error: Address already in use Something is already listening on port 5044, so your beat input cannot use it. ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [February 29, 2020, 11:41am UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/8 "2020-02-29T11:41:29Z")
input { beats { port =\> 5044 } } #filter { # #} output { stdout {codec =\> rubydebug} #elasticsearch { #hosts =\> ["localhost:9200"] #index =\> "%{[@metadata][beat]}-%{[@metadata][version]}" #user =\> "elastic" #password =\> "changeme" #} } ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [March 2, 2020, 11:11am UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/9 "2020-03-02T11:11:44Z")
@Badger And what are the opctions? ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [March 2, 2020, 12:45pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/10 "2020-03-02T12:45:56Z")
@Badger @ahmed_charafouddine @magnusbaeck @Christian_Dahlqvist After searching a lot, I've tried another command: bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/logstash-sample.conf And reports another error: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties [2020-03-02T12:40:25,269][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2020-03-02T12:40:25,792][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.6.0"} [2020-03-02T12:40:30,258][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "=\>" at line 22, column 11 (byte 385) after output {\n #stdout {codec =\> rubydebug}\n elasticsearch {\n hosts =\> ["[http://localhost:9200](http://localhost:9200)"]\n index =\> "%{[@metadata][beat]}-%{[@metadata][version]}"\n #user =\> "elastic"\n #password =\> "changeme"\n #}\n stdout ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in `block in compile_sources'", "org/jruby/RubyArray.java:2580:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:14:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge\_state'"]} Can someone help me, please? Thanks a lot! ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [March 2, 2020, 12:47pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/11 "2020-03-02T12:47:40Z")
> [@Badger](#): > > Something is already listening on port 5044, so your beat input cannot use it. The port 5044 is already in use by another process (check with something like `lsof -i :5044`) — a port can only be used by one process. Maybe you already have another instance of Logstash running. PS: Please format your code for better readability and to keep the indentation. ---
**Author:** ![Pablo95](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Post date:** [March 3, 2020, 11:36am UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/12 "2020-03-03T11:36:06Z")
I've just tried this command and the port 5044 is not listening. Can you please look this code and tell me if you see anything wrong, please? **Command:** `bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/logstash-sample.conf` **And reports another error:** ``` Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties [2020-03-02T12:40:25,269][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2020-03-02T12:40:25,792][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.6.0"} [2020-03-02T12:40:30,258][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\t\r\n], "#", "=>" at line 22, column 11 (byte 385) after output {\n #stdout {codec => rubydebug}\n elasticsearch {\n hosts => ["[http://localhost:9200](http://localhost:9200/)"]\n index => "%{[@metadata][beat]}-%{[@metadata][version]}"\n #user => "elastic"\n #password => "changeme"\n #}\n stdout ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in ` compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in `block in compile_sources'", "org/jruby/RubyArray.java:2580:in ` map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:14:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in ` initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in ` initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in ` block in converge_state'"]} ``` ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [March 3, 2020, 1:07pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/13 "2020-03-03T13:07:55Z")
This is a different / new error. What's on line 22 (or maybe the one before) of your config that could cause that error? ---
**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Post date:** [March 3, 2020, 1:09pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/14 "2020-03-03T13:09:28Z")
can you try to start logstash with this : ``` output{ stdout {} } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 31, 2020, 1:09pm UTC](https://discuss.elastic.co/t/unnable-to-start-logstash-correctly/221424/15 "2020-03-31T13:09:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.