Installed from RPM/systemd Logstash 5 not working

[mrjameshamilton]

Hi, I want to run multiple Logstash instances on the same machine. I installed from RPM according to https://discuss.elastic.co/t/solved-multiple-instances-for-logstash/65539/2

I copied the /etc/logstash folder to /etc/logstash-statistics

When I try sudo systemctl start logstash-statistics.service the process starts but nothing works; not even any output in the log folder.

I try running like this sudo /usr/share/logstash/bin/logstash --path.settings="/etc/logstash-statistics" and get the following error:

ERROR: Failed to load settings file from "path.settings". Aborting... path.setting=/etc/logstash-statistics, exception=Psych::SyntaxError, message=>(<unknown>): expected <block end>, but found BlockMappingStart while parsing a block mapping at line 72 column 2

[mrjameshamilton]

Actually, it doesn't even seem to work from the default location. I'm using the JDBC input & ES output and nothing is happening.

[mrjameshamilton]

When starting with systemd sudo systemctl start logstash.service, error in /var/log/messages:

ERROR: Failed to load settings file from "path.settings". Aborting... path.setting=/etc/logstash, exception=Psych::SyntaxError, message=>(<unknown>): expected <block end>, but found Scalar while parsing a block mapping at line 155 column 2

[mrjameshamilton]

I went back to version 2.4 for now

[suyograo]

@untergeek can you look at this please?

[untergeek]

@mrjameshamilton

Can you please describe the full process you used? I'm currently running two instances of Logstash–from a single, package install–in my home setup with systemd and it works great for me. I'd like to try to replicate your process to see what happened.

[mrjameshamilton]

I've since moved on from this installation and have installed version 5 with Docker successfully since.

[jtyr]

@untergeek I'm having the same problem on CentOS 7. When installed from RPM, systemd starts the service but after a while (approx 2 mins) I receive these messages:

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
ERROR: option '--path.settings': Setting "path.settings" must be a String. Received:  (NilClass)

The problem seems to be in the /etc/systemd/system/logstash.service file:

ExecStart=/usr/share/logstash/bin/logstash "--path.settings"

The parameter --path.settings has no value. This can be fixed by changing that line to this:

ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash

EDIT: I just discovered that I swapped the order of the LS_SETTINGS_DIR and the LS_OPTS variables in the startup.options file that caused the missing path in the service file.

[mrjameshamilton]

I'm having a similar problem again. I installed on a different machine from RPM and nothing is happening and there's no output in the log.

   Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
   Active: active (running) since jeu. 2017-03-16 15:27:36 CET; 4s ago
 Main PID: 22182 (java)
   CGroup: /system.slice/logstash.service
           └─22182 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.en...

mars 16 15:27:36 scadastatslogstashshipper systemd[1]: Started logstash.
mars 16 15:27:36 scadastatslogstashshipper systemd[1]: Starting logstash...

[mrjameshamilton]

If I run it like this: DEBUG=1 /usr/share/logstash/bin/logstash

I get the output:

DEBUG: exec /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb

Should there be further output?

[untergeek]

@mrjameshamilton Is there a possibility you are hitting the slow-startup-because-there's-insufficient-entropy bug? I ask, because with no further output, it could be this.

[untergeek]

See also #5507

[mrjameshamilton]

OK, yes, maybe it's related to that. after a while it seems to start.

[untergeek]

Going to re-close, then, since it seems unrelated to the original issue.