Upgrade Elastic Stack 7.15.1 to 7.17.10

Elastic Stack Logstash
1

Hello Team,

After Upgrade ELK from 7.15.1 to 7.17.10 : logstash-kibana-filebeat-Elastic search , i can't receive log IIS in KIBANA.
when i check log logstash i get this error :

" LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError "

and

" LogStash::Error: Don't know how to handle Java::JavaLang::NoSuchMethodError for `PipelineAction::Create "

Error détails :

[2023-07-31T09:22:25,905][INFO ][logstash.runner          ] Log4j configuration path used is: /etc/logstash/log4j2.properties

[2023-07-31T09:22:25,935][WARN ][logstash.runner ] Logging configuration uses appender or filter with scripting language JavaScript, which will be removed in a future major release of Logstash.
[2023-07-31T09:22:25,948][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.17.10", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 25.372-b07 on 1.8.0_372-b07 +jit [linux-x86_64]"}
[2023-07-31T09:22:25,949][INFO ][logstash.runner ] JVM bootstrap flags: [-Dfile.encoding=UTF-8, -Djava.awt.headless=true, -Dlog4j2.formatMsgNoLookups=true, -XX:+DisableExplicitGC, -XX:+HeapDumpOnOutOfMemoryError, -XX:+UseConcMarkSweepGC, -XX:+UseParNewGC, -XX:HeapDumpPath=/var/log/logstash/, -Xms3g, -Xmx3g, -XX:+UseCMSInitiatingOccupancyOnly, -XX:-OmitStackTraceInFastThrow, -XX:CMSInitiatingOccupancyFraction=75, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+UseGCLogFileRotation, -XX:GCLogFileSize=64m, -XX:NumberOfGCLogFiles=32]
[2023-07-31T09:22:26,262][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2023-07-31T09:22:27,009][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2023-07-31T09:22:28,004][INFO ][org.reflections.Reflections] Reflections took 74 ms to scan 1 urls, producing 119 keys and 419 values
[2023-07-31T09:22:28,945][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError", :message=>"java.nio.MappedByteBuffer.position(I)Ljava/nio/MappedByteBuffer;", :backtrace=>["org.logstash.ackedqueue.io.MmapPageIOV2.create(MmapPageIOV2.java:194)", "org.logstash.ackedqueue.Queue.newCheckpointedHeadpage(Queue.java:386)", "org.logstash.ackedqueue.Queue.openPages(Queue.java:209)", "org.logstash.ackedqueue.Queue.open(Queue.java:176)", "org.logstash.ackedqueue.ext.JRubyAckedQueueExt.open(JRubyAckedQueueExt.java:123)", "org.logstash.ackedqueue.ext.JRubyWrappedAckedQueueExt.initialize(JRubyWrappedAckedQueueExt.java:65)", "org.logstash.ackedqueue.QueueFactoryExt.create(QueueFactoryExt.java:62)", "org.logstash.execution.AbstractPipelineExt.openQueue(AbstractPipelineExt.java:207)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$0$0$openQueue.call(AbstractPipelineExt$INVOKER$i$0$0$openQueue.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:355)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:144)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:345)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:86)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:73)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:549)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:191)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:178)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:208)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:397)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:206)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:325)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:137)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:60)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:750)"]}
[2023-07-31T09:22:28,949][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>"}
[2023-07-31T09:22:29,046][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:135:in `create'", "org/logstash/execution/ConvergeResultExt.java:60:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:405:in `block in converge_state'"]}
[2023-07-31T09:22:29,050][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

thanks for help.
SAMY

2

Hi @SAMY-ELK,

Can you share your Logstash configuration?

3

Hi carly,

Thanks for your help.
Find below logstash configuration :

OS Server: Redhat enterprise_linux:7.9
Version Logstash after Upgrade : 7.17.10
java :-openjdk-1.8.0.372.b07-1.el7_9.x86_64
Ruby : jruby 9.2.20.1 (2.5.8) 2021-11-30
RAM : 8G
CPU: 2
Filebeat : 7.17.10

thanks
SAMY

4

How are you running logstash?

Please share the command line you are using and the configuration.

5

Hi leandrojmp,

logstash is running on VMWARE.

About Config :
OS Server: Redhat enterprise_linux:7.9
Version Logstash after Upgrade : 7.17.10
java :-openjdk-1.8.0.372.b07-1.el7_9.x86_64
Ruby : jruby 9.2.20.1 (2.5.8) 2021-11-30
RAM : 8G
CPU: 2
Filebeat : 7.17.10

About to share the command line : using for what ?

thanks
SAMY

6

How are you starting logstash for example, this may help on the troubleshoot.

7

Hi,

Command line used to start service logstash is : systemctl start logstash.service

I hope answer to your question.

Thanks for help
SAMY

8

Are you sure? According to your logs Logstash is ignoreing pipelines.yml because command line options are being specified, the logstash service does not specify any command line options.

[2023-07-31T09:22:26,262][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

9

Hi,
Im sure, service logstash is started with this command :

systemctl start logstash.service

thanks
SAMY

10

As I mentioned, that is not what the logs are saying.

Was the logstash.service edited? The log clearly states that command line options are being used, this is not the default, so you need to double check this.

Also, you didn't share your configuration.

11

Hi,

You need pipeline config yml ?

Find below config server :

OS Server: Redhat enterprise_linux:7.9
Version Logstash after Upgrade : 7.17.10
java :-openjdk-1.8.0.372.b07-1.el7_9.x86_64
Ruby : jruby 9.2.20.1 (2.5.8) 2021-11-30
RAM : 8G
CPU: 2
Filebeat : 7.17.10

thanks,
SAMY

12

The pipeline configuration with your inputs, filters and outputs.

Also, did you check your logstash.service? Was it edited? How you installed and upgrade Logstash? Using RPM packages?

When you use RPM packages it creates the logstash.service and this logstash.service does not uses any command line options, this is the ExecStart for the default service.

ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"

The log you shared clearly states that logstash is running with command line options.

[2023-07-31T09:22:26,262][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

This would happen if logstash was running using the command line, if the service was edited or if you are using a custom service file.

You need to check this and share how you are running Logstash, something is not right in your installation.

1 Like
13

Hi leandro,

Many thanks for your reply.
Find below the pipeline configuration :

for security reasons I have hidden some values

################################################################

input { beats { port => 5044 }

file {
path => ["/........./"]
start_position => "beginning"
mode => "read"
ignore_older => .......
tags => "........."
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^<?xml"
negate => true
what => "next"
}
}
file {
path => ["........."]
start_position => "beginning"
mode => "read"
ignore_older => .......
tags => "....yyy....."
sincedb_path => "....yyy....."
codec => multiline {
pattern => "^\d{4}-\d{2}-\d{2}\s"
negate => true
what => "next"
charset => "ISO-8859-1"
}
}
file {
path => ["......."]
start_position => "beginning"
mode => "read"
ignore_older => .......
tags => "......"
sincedb_path => "......"
codec => multiline {
pattern => "^<?xml"
negate => true
what => "next"
}
}
file {
path => ["..........."]
start_position => "beginning"
mode => "read"
ignore_older => .......
tags => "......."
sincedb_path => "...."
codec => multiline {
pattern => "^<?xml"
negate => true
what => "next"
}
}

file {
path => ["........."]
start_position => "beginning"
mode => "read"
ignore_older => .......
tags => ["......"]
#file_completed_log_path => "....."
sincedb_path => "....."
codec => multiline {
pattern => "^\d{4}-\d{2}-\d{2}\s"
negate => true
what => "next"
}
}
}
#acceptation filter
filter {

mutate { add_field => { "[@metadata][TEMP_DATA]" => "acceptation" } }
if "......." in [tags] {
    fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
       }
 }
 if "......." in [tags] {
    fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
       }
 }
 if "......." in [tags] {
    fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
       }
 }

 if "......." in [tags] {
    fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
       }
 }
if [client] == "......." {
     grok {     match => ["message", "(?m)%{SYSLOG5424LINE}"] }
 }
if [fields][client] {
   mutate {
            add_field => { "client" => "%{[fields][client]}" }
            remove_field => ["[fields][client]"]
   }

   if [fields][indexname] {
        mutate {
                add_field => { "indexname" => "%{[fields][indexname]}" }
                remove_field => ["[fields][indexname]"]
        }
    }
}

if [client] == "......." {
    ######### Extracting message elements #########
    grok {
        patterns_dir => [ "/etc/logstash/patterns/extra_patterns" ]

        #.......carbon-log
        match => { "message" => "TID:%{SPACE}\[(%{INT:tenant-id})?\]%{SPACE}\[(%{WORD:server-type})?\]%{SPACE}\[%{TIMESTAMP_ISO8601:date-time}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}{%{JAVACLASS:logger-name}}%{SPACE}-%{SPACE}%{LOGMESSAGE:log-message}((\r?\n)%{STACKTRACE:stacktrace})?" }

        #.......errors-log, .......-service-log
        match => { "message" => "%{TIMESTAMP_ISO8601:date-time}%{SPACE}\[%{NOTSPACE:server-type}\]%{SPACE}\[%{GREEDYDATA:logger-name}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}%{NOTSPACE:component}%{SPACE}(%{LOGMESSAGE:log-message})?((\r?\n)%{STACKTRACE:stacktrace})?" }

        #.......httpaccessmanagementconsole-log
        match => { "message" => "%{IP:ip-address}%{SPACE}-%{SPACE}-%{SPACE}\[%{HTTPDATE:date-time}\]%{SPACE}%{QS:method}%{SPACE}%{INT:status}%{SPACE}%{NOTSPACE:time-taken}%{SPACE}%{QS:uri-stem}%{SPACE}%{QS:user-agent}" }

        #.......trace-log
        match => { "message" => "%{TIME:time}%{SPACE}\[-\]%{SPACE}\[%{NOTSPACE:logger-name}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}%{NOTSPACE:component}%{SPACE}%{LOGMESSAGE:log-message}" }

        #ws02patches-log
        match => { "message" => "\[%{TIMESTAMP_ISO8601:date-time}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}\{%{JAVACLASS:logger-name}\}%{SPACE}-%{SPACE}(%{LOGMESSAGE:log-message})?" }

        #.......audit-log
        match => { "message" => "\[%{TIMESTAMP_ISO8601:date-time}\]%{SPACE}%{LOGLEVEL:level}%{SPACE}-%{SPACE}(%{LOGMESSAGE:log-message})?" }

        #.......atomiktransaction-log
        match => { "message" => "%{CAPLOGLEVEL:level}%{SPACE}%{LOGMESSAGE:log-message}((\r?\n)%{STACKTRACE:stacktrace})?" }
    }

    ######### Updating timestamp field #########
    if [type] == ".......trace_log"
    {
        grok {
            match => { "@timestamp" => "%{DATE:date}[T ]%{TIME}" }
            add_field => { "date-time" => "%{date}:%{time}" }
        }
    }

    date {
        match => [ "date-time", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "dd/MMM/yyy:HH:mm:ss Z", "yy-MM-dd:HH:mm:ss,SSS" ]
        target => "@timestamp"
    }

    ######### Removing unused fields #########
    if [type] == ".......httpaccessmanagementconsole_log"
    {
        mutate {
            remove_field => [ "message" ]
        }
    }

    mutate {
        update => { "message" => "%{log-message}" }
        remove_field => [ "date", "time", "date-time", "log-message" ]
    }
}

if [agent][type] == "metricbeat" {

if [event][module] == "system" {
if [client] {
mutate {
update => { "client" => "msys" }
}
} else {
mutate {
add_field => {
"client" => "msys"
}
}
}
}
}
if [event][module] == "iis" {
if [client] {
mutate {
update => { "client" => "iis" }
}
} else {
mutate {
add_field => {
"client" => "iis"
}
}
}
}
if [client] {
mutate {
lowercase => [ "client" ]
}
}

if [indexname] {
        mutate {
            lowercase => [ "indexname" ]
        }
}

}

pipeline.output.global.epp

output {
if [client] {
if [client] == "iis" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-%{[client]}-%{[indexname]}-%{+YYYY.ww}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "winlog.mxl" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-%{[client]}-%{[indexname]}-%{+YYYY.MM}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "winlog.nonmxl" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-%{[client]}-%{[indexname]}-%{+YYYY.MM}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "nginx" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-ia-%{[client]}-%{[indexname]}-%{+YYYY.ww}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "application" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-ia-%{[client]}-%{[indexname]}-%{+YYYY.ww}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "gunicorn" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-ia-%{[client]}-%{[indexname]}-%{+YYYY.ww}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
if [client] == "mongodb" {
if [indexname] {
elasticsearch {
hosts => [".......", "......."]
ssl_certificate_verification => false
index => ".......-ia-%{[client]}-%{[indexname]}-%{+YYYY.ww}"
cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
user => "......."
password => "......."
}
}
}
}

							else
							{

if [tags] == "......." {
  elasticsearch {
    hosts => [".......", "......."]
      ssl_certificate_verification => false
      document_id => "%{[@metadata][fingerprint]}"
      index => "..............-%{+YYYY.MM}"
      cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
      user => "......."
      password => "......."
  }
}
if [tags] == "......." {
  elasticsearch {
    hosts => [".......", "......."]
      ssl_certificate_verification => false
      document_id => "%{[@metadata][fingerprint]}"
      index => ".......-mr.......-......-%{+YYYY.MM}"
      cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
      user => "......."
      password => "......."
  }
}
if [tags] == "......." {
  elasticsearch {
    hosts => [".......", "......."]
      ssl_certificate_verification => false
      document_id => "%{[@metadata][fingerprint]}"
      index => ".......-......-%{+YYYY.MM}"
      cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
      user => "......."
      password => "......."
  }
}
if [tags] == "......." {
  elasticsearch {
    hosts => [".......", "......."]
      ssl_certificate_verification => false
      document_id => "%{[@metadata][fingerprint]}"
      index => ".......-........-%{+YYYY.MM}"
      cacert => "/etc/pki/ca-trust/source/anchors/ca-elasticsearch.pem"
      user => "......."
      password => "......."
  }
}

}

}
#########################################################
did you check your logstash.service ? : how can i check logstash.service ? so that i can share how is running.

How you installed and upgrade Logstash? : i upgrade logstash using puppet and devOps

Many thanks.
SAMY

14

Hi leandro,
this is my config logstash.service :

[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash

Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.

Prefixing the path with '-' makes it try to load, but if the file doesn't

exist, it continues onward.

EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings=/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

When stopping, how long to wait before giving up and sending SIGKILL?

Keep in mind that SIGKILL on a process can cause data loss.

TimeoutStopSec=infinity

[Install]
WantedBy=multi-user.target
~
~
~
~
~

15

I think this is a mismatch between the Java versions used to compile and run logstash. In one version the position function is overridden in the Buffer class, so it returns a Buffer, and in the other it is overridden in MappedByteBuffer, so it returns a MappedByteBuffer. Your JVM has the former, but the byte code expects the latter. If your logstash includes a bundled JDK then try using it. If not, try upgrading the JVM.

17

hi Badger,

Thanks for your help.
But if i use this command `bin/logstash -f /etc/logstash/logstash.conf' i can receive log IIS in KIBANA ...!!
wthout Upgrade JVM

Thanks,
SAMY

18

Something is not right.

Your logstash logs clearly states this:

[2023-07-31T09:22:26,262][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

This would mean that logstash is running with command line options, like -f, but this does not happen when you run logstash as a service and the service file you share clearly was not edited as you can see from the ExecStart line.

ExecStart=/usr/share/logstash/bin/logstash "--path.settings=/etc/logstash

So the presence of this message is not expected when running as a service.

Can you do the following?

First, run systemctl status logstsash and share the result, after that run systemctl start logstash and share the fresh logs generated.

On both cases use the preformatte text option, the </> button, while sharing the response and logs, it makes easier to read and understand.

Second, check the files /etc/default/logstash and/or /etc/sysconfig/logstash and share the content, if they exist.

If this is a Java version issue as Badger mentioned, you may have a custom JVM as a variable on one of those files that the logstash service uses, but when you run it on the command line it does not use those files and runs with the bundled JVM.

19

There is a PR to fix this in 7.17.12. So upgrade to that or downgrade to 7.17.6.

Incidentally, I got the mismatch the wrong way around. The byte code expects java.nio.MappedByteBuffer.position(I)Ljava/nio/MappedByteBuffer to exist, so it was compiled for Java 9, but you are running 1.8, which does not support that method.

20

Hi Leandro,

Thanks for your help.
I've upgraded to version 7.17.11 and I'm having the same problem.

Here is the result of the 'systemctl status logstsash' and 'systemctl start logstash' commands:

</>
/home/xxxx077 #systemctl status logstash.service
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2023-08-08 09:33:13 EDT; 6s ago
Main PID: 9032 (java)
Tasks: 15
Memory: 364.3M
CGroup: /system.slice/logstash.service
└─9032 /usr/bin/java -Dfile.encoding=UTF-8 -Djava.awt.headless=true -Dlog4j2.formatMsgNoLookups=true -XX:+DisableExplicitGC -XX:+HeapDumpOnOutOfMemoryError -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -XX:HeapDumpPath=/var/log/...

Aug 08 09:33:13 xxxxx848 systemd[1]: Started logstash.
Aug 08 09:33:15 xxxxx848 logstash[9032]: Desired survivor size 8716288 bytes, new threshold 1 (max 6)
Aug 08 09:33:15 xxxxx848 logstash[9032]: - age 1: 17380928 bytes, 17380928 total
Aug 08 09:33:17 xxxxx848 logstash[9032]: Desired survivor size 8716288 bytes, new threshold 1 (max 6)
Aug 08 09:33:17 xxxxx848 logstash[9032]: - age 1: 12206456 bytes, 12206456 total
Aug 08 09:33:19 xxxxx848 logstash[9032]: Desired survivor size 8716288 bytes, new threshold 1 (max 6)
Aug 08 09:33:19 xxxxx848 logstash[9032]: - age 1: 12009504 bytes, 12009504 total
/home/xxxx077 #systemctl start logstash.service
</>

the fresh logs generated:

</>

[2023-08-08T09:33:09,333][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2023-08-08T09:33:09,348][WARN ][logstash.runner ] Logging configuration uses appender or filter with scripting language JavaScript, which will be removed in a future major release of Logstash.
[2023-08-08T09:33:09,359][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.17.11", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 25.372-b07 on 1.8.0_372-b07 +jit [linux-x86_64]"}
[2023-08-08T09:33:09,361][INFO ][logstash.runner ] JVM bootstrap flags: [-Dfile.encoding=UTF-8, -Djava.awt.headless=true, -Dlog4j2.formatMsgNoLookups=true, -XX:+DisableExplicitGC, -XX:+HeapDumpOnOutOfMemoryError, -XX:+UseConcMarkSweepGC, -XX:+UseParNewGC, -XX:HeapDumpPath=/var/log/logstash/, -Xms3g, -Xmx3g, -XX:+UseCMSInitiatingOccupancyOnly, -XX:-OmitStackTraceInFastThrow, -XX:CMSInitiatingOccupancyFraction=75, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+UseGCLogFileRotation, -XX:GCLogFileSize=64m, -XX:NumberOfGCLogFiles=32]
[2023-08-08T09:33:09,603][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2023-08-08T09:33:10,200][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2023-08-08T09:33:11,499][INFO ][org.reflections.Reflections] Reflections took 74 ms to scan 1 urls, producing 119 keys and 419 values
[2023-08-08T09:33:12,767][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError", :message=>"java.nio.MappedByteBuffer.position(I)Ljava/nio/MappedByteBuffer;", :backtrace=>["org.logstash.ackedqueue.io.MmapPageIOV2.recover(MmapPageIOV2.java:158)", "org.logstash.ackedqueue.Queue.openPages(Queue.java:256)", "org.logstash.ackedqueue.Queue.open(Queue.java:176)", "org.logstash.ackedqueue.ext.JRubyAckedQueueExt.open(JRubyAckedQueueExt.java:123)", "org.logstash.ackedqueue.ext.JRubyWrappedAckedQueueExt.initialize(JRubyWrappedAckedQueueExt.java:65)", "org.logstash.ackedqueue.QueueFactoryExt.create(QueueFactoryExt.java:62)", "org.logstash.execution.AbstractPipelineExt.openQueue(AbstractPipelineExt.java:207)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$0$0$openQueue.call(AbstractPipelineExt$INVOKER$i$0$0$openQueue.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:355)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:144)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:345)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:86)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:73)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:549)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:191)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:178)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:208)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:397)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:206)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:325)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:137)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:60)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:750)"]}
[2023-08-08T09:33:12,771][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>"}
[2023-08-08T09:33:12,927][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:135:in create'", "org/logstash/execution/ConvergeResultExt.java:60:in add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:405:in block in converge_state'"]} [2023-08-08T09:33:12,931][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?] at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?] [2023-08-08T09:33:26,474][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties [2023-08-08T09:33:26,500][WARN ][logstash.runner ] Logging configuration uses appender or filter with scripting language JavaScript, which will be removed in a future major release of Logstash. [2023-08-08T09:33:26,515][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.17.11", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 25.372-b07 on 1.8.0_372-b07 +jit [linux-x86_64]"} [2023-08-08T09:33:26,526][INFO ][logstash.runner ] JVM bootstrap flags: [-Dfile.encoding=UTF-8, -Djava.awt.headless=true, -Dlog4j2.formatMsgNoLookups=true, -XX:+DisableExplicitGC, -XX:+HeapDumpOnOutOfMemoryError, -XX:+UseConcMarkSweepGC, -XX:+UseParNewGC, -XX:HeapDumpPath=/var/log/logstash/, -Xms3g, -Xmx3g, -XX:+UseCMSInitiatingOccupancyOnly, -XX:-OmitStackTraceInFastThrow, -XX:CMSInitiatingOccupancyFraction=75, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+UseGCLogFileRotation, -XX:GCLogFileSize=64m, -XX:NumberOfGCLogFiles=32] [2023-08-08T09:33:26,911][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2023-08-08T09:33:27,669][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false} [2023-08-08T09:33:29,322][INFO ][org.reflections.Reflections] Reflections took 71 ms to scan 1 urls, producing 119 keys and 419 values [2023-08-08T09:33:30,432][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError", :message=>"java.nio.MappedByteBuffer.position(I)Ljava/nio/MappedByteBuffer;", :backtrace=>["org.logstash.ackedqueue.io.MmapPageIOV2.recover(MmapPageIOV2.java:158)", "org.logstash.ackedqueue.Queue.openPages(Queue.java:256)", "org.logstash.ackedqueue.Queue.open(Queue.java:176)", "org.logstash.ackedqueue.ext.JRubyAckedQueueExt.open(JRubyAckedQueueExt.java:123)", "org.logstash.ackedqueue.ext.JRubyWrappedAckedQueueExt.initialize(JRubyWrappedAckedQueueExt.java:65)", "org.logstash.ackedqueue.QueueFactoryExt.create(QueueFactoryExt.java:62)", "org.logstash.execution.AbstractPipelineExt.openQueue(AbstractPipelineExt.java:207)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$0$0$openQueue.call(AbstractPipelineExt$INVOKER$i$0$0$openQueue.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:355)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:144)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:345)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:86)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:73)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:549)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:191)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:178)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:208)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:397)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:206)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:325)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:137)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:60)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:750)"]} [2023-08-08T09:33:30,436][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle Java::JavaLang::NoSuchMethodErrorforPipelineAction::Create"} [2023-08-08T09:33:30,531][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle Java::JavaLang::NoSuchMethodErrorforPipelineAction::Create>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:135:in create'", "org/logstash/execution/ConvergeResultExt.java:60:in add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:405:in block in converge_state'"]}
[2023-08-08T09:33:30,541][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]
[2023-08-08T09:33:44,107][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2023-08-08T09:33:44,120][WARN ][logstash.runner ] Logging configuration uses appender or filter with scripting language JavaScript, which will be removed in a future major release of Logstash.
[2023-08-08T09:33:44,126][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.17.11", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 25.372-b07 on 1.8.0_372-b07 +jit [linux-x86_64]"}
[2023-08-08T09:33:44,127][INFO ][logstash.runner ] JVM bootstrap flags: [-Dfile.encoding=UTF-8, -Djava.awt.headless=true, -Dlog4j2.formatMsgNoLookups=true, -XX:+DisableExplicitGC, -XX:+HeapDumpOnOutOfMemoryError, -XX:+UseConcMarkSweepGC, -XX:+UseParNewGC, -XX:HeapDumpPath=/var/log/logstash/, -Xms3g, -Xmx3g, -XX:+UseCMSInitiatingOccupancyOnly, -XX:-OmitStackTraceInFastThrow, -XX:CMSInitiatingOccupancyFraction=75, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+UseGCLogFileRotation, -XX:GCLogFileSize=64m, -XX:NumberOfGCLogFiles=32]
[2023-08-08T09:33:44,406][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2023-08-08T09:33:44,965][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2023-08-08T09:33:46,330][INFO ][org.reflections.Reflections] Reflections took 91 ms to scan 1 urls, producing 119 keys and 419 values
[2023-08-08T09:33:47,485][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::NoSuchMethodError", :message=>"java.nio.MappedByteBuffer.position(I)Ljava/nio/MappedByteBuffer;", :backtrace=>["org.logstash.ackedqueue.io.MmapPageIOV2.recover(MmapPageIOV2.java:158)", "org.logstash.ackedqueue.Queue.openPages(Queue.java:256)", "org.logstash.ackedqueue.Queue.open(Queue.java:176)", "org.logstash.ackedqueue.ext.JRubyAckedQueueExt.open(JRubyAckedQueueExt.java:123)", "org.logstash.ackedqueue.ext.JRubyWrappedAckedQueueExt.initialize(JRubyWrappedAckedQueueExt.java:65)", "org.logstash.ackedqueue.QueueFactoryExt.create(QueueFactoryExt.java:62)", "org.logstash.execution.AbstractPipelineExt.openQueue(AbstractPipelineExt.java:207)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$0$0$openQueue.call(AbstractPipelineExt$INVOKER$i$0$0$openQueue.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:355)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:144)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:345)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:86)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:73)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:549)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:191)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:178)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:208)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:397)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:206)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:325)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:137)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:60)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:750)"]}
[2023-08-08T09:33:47,492][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>"}
[2023-08-08T09:33:47,606][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle Java::JavaLang::NoSuchMethodError for PipelineAction::Create<main>>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:135:in `create'", "org/logstash/execution/ConvergeResultExt.java:60:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:405:in `block in converge_state'"]}
[2023-08-08T09:33:47,610][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

</>

Here is the content of '/etc/default/logstash' :

</>
JAVACMD="/usr/bin/java"
LS_GC_LOG_FILE="/var/log/logstash/gc.log"
LS_GROUP="logstash"
LS_HOME="/usr/share/logstash"
LS_NICE="19"
LS_OPEN_FILES="16384"
LS_PIDFILE="/var/run/logstash.pid"
LS_SETTINGS_DIR="/etc/logstash"
LS_USER="logstash"
SERVICE_DESCRIPTION="logstash"
SERVICE_NAME="logstash"
</>

I don't find logstash on '/etc/sysconfig'

21

As I said yesterday, it is fixed in 7.17.12, so upgrade to that or downgrade to 7.17.6.