Nagios Support Forum

Logstash Collector isn't starting, when I click on start under SYSTEM> System Status. It starts for sometime and then again stops.

While the logstash collector is "red", can you share the output of:
Is there anything in the logstash log? Would you mind sharing it's contents?

[root@ip-10-1-252-201 ec2-user]# service logstash status
Logstash Daemon dead but pid file exists


logstash.log attached for your reference

Can you share the outputs of:
It looks as if the machine is not able to resolve localhost based on outputs in the other thread. By default, logstash is attempting to connect to the elasticsearch database on localhost.

[root@ip-10-1-252-201 ftw]# ls -al /usr/local/nagioslogserver/logstash/etc/conf.d/
total 20
drwxrwxr-x. 2 nagios nagios 4096 Sep 7 16:33 .
drwxrwxr-x. 3 nagios nagios 4096 Sep 7 14:26 ..
-rwxrwxr-x 1 nagios nagios 218 Sep 7 18:09 000_inputs.conf
-rwxrwxr-x 1 nagios nagios 220 Sep 7 18:09 500_filters.conf
-rwxrwxr-x 1 nagios nagios 537 Sep 7 18:09 999_outputs.conf
[root@ip-10-1-252-201 ftw]# cat /usr/local/nagioslogserver/logstash/etc/conf.d/*
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Wed, 07 Sep 2016 18:09:21 +0000
#

#
# Global inputs
#



#
# Local inputs
#


#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Wed, 07 Sep 2016 18:09:21 +0000
#

#
# Global filters
#



#
# Local filters
#


#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Wed, 07 Sep 2016 18:09:21 +0000
#

#
# Required output for Nagios Log Server
#

output {
elasticsearch {
cluster => '0418383b-07ee-4161-ad5b-e7d7e3b1e9d8'
host => 'localhost'
document_type => '%{type}'
node_name => '2f526f36-8df4-4c76-b884-13a523776c3b'
protocol => 'transport'
workers => 4
}
}

#
# Global outputs
#



#
# Local outputs
#


[root@ip-10-1-252-201 ftw]# cat /etc/hosts
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
[root@ip-10-1-252-201 ftw]#

Can you change the /etc/hosts definition to include localhost under the ipv6 loopback and see if that resolves this issue?
It looks like you do not have any inputs configured. Can you try applying configuration via the NLS GUI and see if it produces any errors?
Can you also share the outputs of the following:

Adding Input filter fixed the problem, thanks once again

Awesome! Is it alright if we lock this thread and mark the issue as resolved?

Yes please! Thank you once again