2

I just downloaded logstash 7.6.0 in windows 10. I already have elastic search (7.6.0) and kibana (7.6.0) running. When I run logstash.bat with default configuration it gives this error.

Error: Could not find or load main class Heal

I have jdk 11 installed and I checked that the environment variable is set. Please help.

EDIT: Added config file

input{
    file =>"D://logfile-2020-03-22.log"
    start_position => "beginning"
    type => "json"
}

output{
    elasticsearch {
        hosts => ["localhost:9200"]
    }
}

Actually this same configuration is working fine on one of our servers. But when I am trying to set it up locally it is giving this error. The only differences I can find is the OS (Windows server 2012 r2 vs windows 10) and the version of ELK stack (7.6.1 on server and 7.6.0 locally)

Faizal
  • 41
  • 6
  • 1
    Please provide more logs / snippets which will help while understand problem more. – Akshay Mar 24 '20 at 06:16
  • There are no logs generated in logstash, even when I run it using --debug flag it still gives only the error mentioned in the question. – Faizal Apr 04 '20 at 06:20

3 Answers3

3

Remember that you mustn't run logstash from a folder that contains space in the name (like "Program Files"). Move it to "C:\myFolderNameWithoutWhitespace".

NoJoshua
  • 374
  • 3
  • 11
  • I thought this can't be, but you are right it does not work with folders having space in their name even on mac. When I searched, one of the reasons which seems valid was URI in ruby does not work well with spaces and this library uses Jruby. https://stackoverflow.com/questions/41391781/logstash-5-1-1-bad-uriis-not-uri – Vivek Tiwary Mar 11 '22 at 12:31
1

It looks like the issue was with my Java installation, I uninstalled my java (java 8) and downloaded java version 11 and it solved the issue.

Faizal
  • 41
  • 6
0

You have to create a new configuration file for logstash to output to Elasticsearch. Give it any name like first-pipeline.conf and paste below content.

# The # character at the beginning of a line indicates a comment. Use 
# comments to describe your configuration.
input {
 #standard input
 stdin { }
 #filebeat input
 # beats {
 #    port => "5044"
 #}
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
  }
}

Now from the commandline run the below command

bin>logstash -f first-pipeline.conf
abhinav pratap
  • 623
  • 8
  • 15