Skip to main content
Version: 4.12.x.x LTS

Logstash Troubleshooting

Checking the Status of the Starting Service​

Run following commands to make sure that the service has started completely:

# To view the status of service starting.
systemctl status logstash
# To view log of service starting to ensure the service is started without issue.
journalctl -u logstash

Checking the Configuration of the Installed Logstash​

The configuration of Logstash is stored in the /var/opt/logstash/settings directory by default.

cat /var/opt/logstash/settings/logstash.yml

Viewing the Logstash Logs​

For the purpose of testing and debugging, you can view the logs while starting the service:

tail -f /var/opt/logstash/logs/logstash-plain.log

Issue: Logstash is Running but not Storing Logs in Elasticsearch​

The Logstash logs may contain the following errors:

Attempted to send a bulk request to elasticsearch, but no there are no living connections in the connection pool. Perhaps Elasticsearch is unreachable or down? {:error_message=>"No Available connections", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError", :will_retry_in_seconds=>4}
Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}

These errors occur because either the Elasticsearch is not reachable or the Logstash configuration is pointing to a wrong host.

To solve this issue:

  • Ensure that Elasticsearch is running (see Elasticsearch troubleshooting).
  • Check the Logstash output configuration stored in the directory /var/opt/logstash/conf/outputs to verify if the line host => localhost:9200 points to the right host:
output {
 elasticsearch {
 hosts => localhost:9200
...