# Unusually rare error with regard to logstash

**URL:** <https://discuss.elastic.co/t/unusually-rare-error-with-regard-to-logstash/213913>\
**Category:** Logstash\
**Created:** [January 6, 2020, 4:06pm UTC](https://discuss.elastic.co/t/unusually-rare-error-with-regard-to-logstash/213913 "2020-01-06T16:06:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PhobosDthorga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phobosdthorga/32/60335_2.png) [@PhobosDthorga](https://discuss.elastic.co/u/PhobosDthorga)\
**Post date:** [January 6, 2020, 4:06pm UTC](https://discuss.elastic.co/t/unusually-rare-error-with-regard-to-logstash/213913/1 "2020-01-06T16:06:33Z")

</div>

Hello everyone!

We at [GekkoFyre Networks](https://gekkofyre.io/) are encountering an issue with `logstash` where we keep experiencing the same error over and over [1], causing the service to restart repeatedly until eventually, systemd terminates the misbehaving daemon.

[1] - [https://paste.gekkofyre.io/view/a16eb1f2](https://paste.gekkofyre.io/view/a16eb1f2)

Below you will find the configuration files relating to our Logstash setup within our metrics oriented server as well.

[2] - [https://paste.gekkofyre.io/view/51e0207c](https://paste.gekkofyre.io/view/51e0207c)

The virtual private server we've created for this particular workload also has plenty of resources itself, so we're pretty confident that this is not the cause at hand, with regard to the error experienced by `logstash`.

```bash
root@metrics:~# cat /proc/cpuinfo | grep processor | wc -l
6
root@metrics:~# free -h
              total used free shared buff/cache available
Mem: 11G 4.4G 2.5G 39M 4.9G 7.1G
Swap: 2.0G 0B 2.0G
[root@norwaro ~]# inxi -C
CPU: Topology: Quad Core model: Intel Xeon E3-1270 v6 bits: 64 type: MT MCP L2 cache: 8192 KiB
           Speed: 1108 MHz min/max: 800/4200 MHz Core speeds (MHz): 1: 1108 2: 908 3: 1150 4: 1056 5: 1398 6: 1137 7: 1361
           8: 2218
[root@norwaro ~]#

```

We've probably allocated too much RAM at this point in time actually, so I might have to reduce it by around 4 GB. But we'd appreciate any and all help on this matter, thank you. We are ultimately trying to setup [sýnesis Lite for Suricata](https://github.com/robcowart/synesis_lite_suricata) under Kibana and ElasticSearch.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 6, 2020, 5:53pm UTC](https://discuss.elastic.co/t/unusually-rare-error-with-regard-to-logstash/213913/2 "2020-01-06T17:53:36Z")

</div>

Try running with --config.debug --log.level debug --config.test\_and\_exit on the command line. That will show you each file that it is loading as part of the configuration, and it will show you the merged configuration. You can then identify where line 14 is coming from.

Hang on, don't you need "output {" and "}" at the start and end of your /etc/logstash/conf.d/30-elasticsearch-output.conf?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 3, 2020, 5:53pm UTC](https://discuss.elastic.co/t/unusually-rare-error-with-regard-to-logstash/213913/3 "2020-02-03T17:53:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.