Logstash報錯：Logstash could not be started because there is already another instance using the configured data directory

錯誤一：

1、錯誤提示：

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2019-12-26T07:31:29,884][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-12-26T07:31:30,007][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2019-12-26T07:31:30,026][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

2、原因：之前運行的instance有緩沖，保存在path.data里面有.lock文件，刪除掉就可以。

3、 解決辦法：在 logstash.yml 文件中找到 Data path 的路徑(默認在安裝目錄的data目錄下）

4、重新啟動以后正常：

 

 

錯誤二：

1、錯誤提示：

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2019-12-26T07:57:58,880][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-12-26T07:58:00,268][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.4.0"}
[2019-12-26T07:58:01,379][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, \", ', } at line 2, column 11 (byte 20) after input { \n stdin { ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in `block in converge_state'"]}

 

 

2、原因：配置腳本可能符號或空格有問題

3、 解決辦法：建議手打一遍配置文件

 

附：配置腳本如下，從屏幕輸入  屏幕輸出

input { stdin { } }

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}
 
output {
  stdout { codec => rubydebug }
}