WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash

[lifeofguenter]

As root:

# /usr/share/logstash/bin/logstash --path.settings /etc/logstash/logstash.yml -t
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /etc/logstash/logstash.yml/log4j2.properties. Using default config which logs to console

makes configtest pretty useless...

[lifeofguenter]

can be closed, needs to be run as user logstash under debian:

$ sudo -Hu logstash /usr/share/logstash/bin/logstash --path.settings=/etc/logstash -t

works!

[sconrod-tester]

Getting error Java is not in Path but it definitely is in the path

root@ubuntu-16:~# sudo -Hu logstash /usr/share/logstash/bin/logstash --path.settings=/etc/logstash -t
Could not find any executable java binary. Please install java in your PATH or set JAVA_HOME.
cat /etc/environment
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
JAVA_HOME="/usr/lib/jvm/java-8-oracle/jre/bin/java"

root@ubuntu-16:~# update-alternatives --config java
There is only one alternative in link group java (providing /usr/bin/java): /usr/lib/jvm/java-8-oracle/jre/bin/java
Nothing to configure.

root@ubuntu-16:~# echo $JAVA_HOME
/usr/lib/jvm/java-8-oracle/jre/bin/java

[jordansissel]

sudo -Hu logstash

sudo resets your environment in most cases.

What is the full output of sudo -Hu logstash env ?

[sconrod-tester]

root@ubuntu-16:~# sudo -Hu logstash env
TERM=xterm
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
LANG=en_US.UTF-8
HOME=/usr/share/logstash
MAIL=/var/mail/logstash
LOGNAME=logstash
USER=logstash
USERNAME=logstash
SHELL=/usr/sbin/nologin
SUDO_COMMAND=/usr/bin/env
SUDO_USER=root
SUDO_UID=0
SUDO_GID=0
JAVA_HOME=/usr/lib/jvm/java-8-oracle/jre/bin/java
root@ubuntu-16:~#
****

[sconrod-tester]

not sure why it formatted the text with cross through...

[jordansissel]

@sconrod-tester it saw the ~ and thought you wanted strikethrough. I fixed it by wrapping with ```

JAVA_HOME=/usr/lib/jvm/java-8-oracle/jre/bin/java

This is probably not right, it should be the path to the root of the java install, I think /usr/lib/jvm/java-8-oracle/jre/ (I never use JAVA_HOME, so I don't know if this is an accurate answer, though, please try it)

[sconrod-tester]

Ok I see my issue, I had to update the /etc/environment with:
JAVA_HOME="/usr/lib/jvm/java-8-oracle"

[jordansissel]

Did this fix it for you?

[sconrod-tester]

No I am still getting the error when i try to load the pipeline:
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logs│[2017-11-07T14:21:19,756][INFO ][logstash.modules.scaffold] Initializing module {:module_name=
tash. You can specify the path using --path.settings. Continuing using the defaults │>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using│[2017-11-07T14:21:33,079][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"
default config which logs errors to the console

[jordansissel]

^^ this your JAVA_HOME problem is resolved. You are somehow missing a instruction to Logstash to have it know where to find configuration.

I recommend you ask about this on https://discuss.elastic.co/ as you may find better getting-started assistance there.

[sconrod-tester]

Hi, My logastash.yml is configured correctly to find the configuration files as per the article here:

Where to fetch the pipeline configuration for the main pipeline

path.config: /etc/logstash/conf.d

[sconrod-tester]

root@ubuntu-16:/usr/share/logstash# /usr/share/logstash/bin/logstash --default.path.conf=/etc/logstash/conf.d/
2017-11-07 16:26:58,154 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"

[sconrod-tester]

Hi I am still getting the error when trying to initialize a new pipeline: WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console verified Java is set correctly in the path. Ideas?

…

On Tue, Nov 7, 2017 at 2:28 PM, Jordan Sissel ***@***.***> wrote: ^^ this your JAVA_HOME problem is resolved. You are somehow missing a instruction to Logstash to have it know where to find configuration. I recommend you ask about this on https://discuss.elastic.co/ as you may find better getting-started assistance there. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6921 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMwBUSfU5YOzwwF6pfs6u6V1_x6DxHhDks5s0NmEgaJpZM4M90qz> .