V5.3 won't start on CentOS 7.3

Elastic Stack Logstash
#1

Installed logstash 5.3 from the official repository and tried to run the following command (from https://www.elastic.co/guide/en/logstash/current/first-event.html):

# /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'
OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
hello world
^C

Nothing happens. After starting the java process uses 100% CPU for 10-15 seconds and that's it. Nothing in /var/log/messages or /var/log/logstash.

Java packages installed:
java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.x86_64
java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.x86_64

Any ideas about what I'm doing wrong here?

#2

Also tried Oracle's JDK 1.8.0_112 but no luck. Same behavior.

I tried logstash 5.3.0 on Fedora 25 with Oracle JDK 1.8.0_112 and it worked, so it seems the behavior is limited to CentOS.

#3

How did you install? An RPM? Did you try adding --path.settings /etc/logstash, since you're executing from the command-line, rather than the default systemd startup method?

#4

I installed it through the RPM package (https://artifacts.elastic.co/packages/5.x/yum).

The --path.settings options doesn't seem to have an effect.

However, after 15-20min or so, it started!

I'm currently re-running with strace to try to identify what's trying to do all that time.

#5 
# date; /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'; date
Tue Mar 28 19:40:15 UTC 2017
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
19:44:09.125 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
19:44:09.223 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
The stdin plugin is now waiting for input:
19:44:09.458 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
abc
2017-03-28T19:45:56.075Z hostname abc

And specifying the path, it seems to die (with default settings, although I am specifying '-e' so this is weird):

# date; /usr/share/logstash/bin/logstash --path.settings /etc/logstash -e 'input { stdin { } } output { stdout {} }'; date
Tue Mar 28 19:47:27 UTC 2017
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Tue Mar 28 19:49:38 UTC 2017
#6

Sounds like you're on a VM. That means you probably have insufficient entropy. https://github.com/elastic/logstash/issues/6117 Has some workarounds.

#7

I think that was exactly it!

I kept the VM busy and now I'm getting a consistent <1min startup time. Thank you!

#8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.