Why my logstash keeps on restarting!

Elastic Stack Logstash
1

Hi,
I'm new to logstash.I have installed logstash and started it using sudo service logstash start ,it works perfectly until today morning. I don't have any idea what happened after that !
Now i tried the same configuration file (executed earlier,worked fine) but it has no response .So checked the logstash status ,it shows it's status as

       **Active: active (running) since Fri 2019-03-29 17:51:58 IST; 30s ago**

But i have started it before 30 minutes it shows 30s ago . What was the problem ? Do i need to change any configuration file ?? I have tried reinstalling logstash too but it won't work in my case !
Thanks in advance !

2

What is in the logstash logs? They are probably in /var/log/logstash.

3

@Badger FYR : logs in var/log/logstash:

[2019-03-29T18:01:21,850][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.6.2"}
[2019-03-29T18:01:22,823][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
[2019-03-29T18:01:22,833][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2019-03-29T18:01:23,169][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

4

Does that pattern match any files?

5

@Badger No ..folder conf.d is empty

6

OK, so you do not have a configuration. Either something deleted the configuration, and you need to recreate it, or you were telling logstash to look somewhere else for the configuration. I cannot add much more since I do not know how you are starting logstash, what command line options you are using, what logstash.yml looks like, etc.

7

To start : sudo service logstash start

To run the config : sudo /usr/share/logstash/bin/logstash -f /home/gomathi/sample.conf

8

So then you have no config for the service. Move your config file into /etc/logstash/conf.d

10

I have tried uninstall the whole ELK and then installed it again after removing all the files. Now its working fine for me !!!

1 Like
11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.