Nagios Support Forum

Hi Team,
Loagstash dead but pid file exist is the error.
Below is the error observed. No logstash files are generating

[root@xxx tmp]# cd /var/log/logstash/
[root@xxx logstash]# ls -lrt
total 142336
-rw-r--r--. 1 nagios nagios 72986561 Feb 5 2019 logstash.log-20190205
-rw-r--r--. 1 nagios nagios 72702098 Feb 15 2019 logstash.log-20190215
-rw-r--r--. 1 nagios nagios 423 Mar 11 03:45 logstash.log-20200311
-rw-r--r--. 1 nagios nagios 607 Mar 13 03:50 logstash.log-20200313
-rw-r--r--. 1 nagios nagios 8779 Apr 23 03:12 logstash.log-20200423
-rw-r--r--. 1 nagios nagios 1387 May 22 03:12 logstash.log-20200522.gz
-rw-r--r--. 1 nagios nagios 6310 May 25 03:48 logstash.log-20200525.gz
-rw-r--r--. 1 nagios nagios 992 May 27 03:41 logstash.log-20200527.gz
-rw-r--r--. 1 nagios nagios 350 May 29 03:06 logstash.log-20200529.gz
-rw-r--r--. 1 nagios nagios 552 May 30 03:23 logstash.log-20200530.gz
-rw-r--r-- 1 nagios nagios 190 May 31 03:37 logstash.log-20200531.gz
-rw-r--r-- 1 nagios nagios 161 Jun 3 03:45 logstash.log-20200603.gz
-rw-r--r--. 1 nagios nagios 0 Jun 3 03:45 logstash.log


command:
nice -n 19 runuser -s /bin/sh -c "exec /usr/local/nagioslogserver/logstash/bin/logstash agent -f /usr/local/nagioslogserver/logstash/etc/conf.d --verbose" nagios

output:
Starting pipeline {:id=>"main", :pipeline_workers=>2, :batch_size=>125, :batch_delay=>5, :max_inflight=>250, :level=>:info}
Pipeline main started
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp type=>"eventlog", port=>3515, codec=><LogStash::Codecs::JSON charset=>"CP1252">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp type=>"import_json", tags=>["import_json"], port=>2057, codec=><LogStash::Codecs::JSON charset=>"UTF-8">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp type=>"import_raw", tags=>["import_raw"], port=>2056, codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5556, type=>"WAS-System-logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5555, type=>"HTTP-logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5559, type=>"ohs_logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>8181, type=>"ohs_access_logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5557, type=>"osb_access", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5558, type=>"webseal-logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5551, type=>"mmg-log", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>3516, type=>"ApplicationLogs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>3517, type=>"WSLProcess", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5553, type=>"siebel_access_log", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5552, type=>"soa_access", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5559, type=>"ohs_logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp type=>"import_json", tags=>["import_json"], port=>2057, codec=><LogStash::Codecs::JSON charset=>"UTF-8">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Tcp port=>5556, type=>"WAS-System-logs", codec=><LogStash::Codecs::Line charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", data_timeout=>-1, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
Error: Address already in use {:level=>:error}

[root@xx logstash]# service logstash status
Logstash Daemon dead but pid file exists
[root@xx logstash]# df -h
Filesystem Size Used Avail Use% Mounted on
rootfs 99G 38G 61G 39% /
devtmpfs 32G 164K 32G 1% /dev
tmpfs 32G 4.0K 32G 1% /dev/shm
/dev/sda1 99G 38G 61G 39% /
/dev/mapper/vg_app-lv_app
1.9T 618G 1.3T 34% /app



[root@xx tmp]# more ls.txt
total 32
drwxrwxr-x. 2 nagios nagios 4096 Jun 11 17:43 var
drwxrwxr-x. 3 nagios nagios 4096 Jun 11 18:06 tmp
drwxrwxr-x. 2 nagios nagios 4096 Jun 11 18:06 snapshots
drwxrwxr-x. 2 nagios nagios 4096 Jun 11 17:42 scripts
drwxrwxr-x. 2 nagios nagios 4096 Dec 21 2015 mibs
drwxrwxr-x. 6 nagios nagios 4096 May 9 2018 logstash
drwxrwxr-x. 4 nagios nagios 4096 Jun 11 17:42 etc
drwxrwxr-x. 7 nagios nagios 4096 Dec 21 2015 elasticsearch
/:
total 262268
dr-xr-xr-x. 24 root root 4096 Jun 2 12:34 .
dr-xr-xr-x. 24 root root 4096 Jun 2 12:34 ..
drwxr-xr-x. 5 root root 4096 Jun 11 17:38 app
-rw-r--r-- 1 root root 0 Jun 2 12:34 .autofsck
-rw-r--r-- 1 root root 0 May 30 11:22 .autorelabel
dr-xr-xr-x. 2 root root 4096 Aug 14 2017 bin
dr-xr-xr-x. 4 root root 4096 Aug 14 2017 boot
-rw-r--r--. 1 root root 1176 Mar 17 2017 ca.crt
-rw-r--r--. 1 root root 993 Mar 17 2017 ca.csr
-rw-r--r--. 1 root root 1679 Mar 17 2017 ca.key
drwxr-xr-x 17 root root 3780 Jun 3 16:26 dev
drwxr-xr-x. 82 root root 4096 Jun 11 17:42 etc
drwxr-xr-x. 9 root root 4096 Apr 8 13:52 home
dr-xr-xr-x. 11 root root 4096 Jun 11 17:40 lib
dr-xr-xr-x. 9 root root 12288 Jun 11 17:40 lib64
drwx------. 9 root root 16384 Oct 17 2012 lost+found
drwxr-xr-x. 2 root root 4096 Sep 23 2011 media
drwxrwxr-x. 3 nagios nagios 4096 May 3 2018 mnt
drwxr-xr-x. 3 root root 4096 Sep 7 2017 opt
dr-xr-xr-x 143 root root 0 Jun 2 05:33 proc
dr-xr-x---. 8 root root 4096 Jun 11 17:40 root
dr-xr-xr-x. 2 root root 12288 Oct 8 2018 sbin
drwxr-xr-x. 2 root root 4096 Oct 17 2012 selinux
drwxr-xr-x. 2 root root 4096 Sep 23 2011 srv
drwxr-xr-x. 3 nagios nagios 4096 Dec 21 2015 store
-rw-------. 1 root root 268435456 Sep 25 2013 swapfile1
drwxr-xr-x 13 root root 0 Jun 2 05:33 sys
drwxrwxrwt. 16 root root 4096 Jun 11 18:15 tmp
drwxr-xr-x. 13 root root 4096 Oct 17 2012 usr
drwxr-xr-x. 18 root root 4096 Dec 21 2015 var

/var/log:
total 520
drwxrwx---. 25 root root 12288 Jun 9 08:18 .
drwxr-xr-x. 18 root root 4096 Dec 21 2015 ..
-rw-r--r-- 1 root root 2956 Jun 1 15:02 1
drwx------. 2 root root 4096 Apr 27 13:53 29
drwx------. 2 root root 4096 Apr 28 02:18 9
drwxr-x---. 2 root root 4096 Jun 11 15:01 audit
drwx------. 2 root root 4096 Oct 28 2018 b
-rw-r--r-- 1 root root 1929 Jun 2 12:34 boot.log
-rw------- 1 root utmp 384 Jun 1 08:28 btmp
-rw-------. 1 root utmp 768 May 25 20:08 btmp-20200601
drwxr-xr-x. 2 root root 4096 Jun 3 03:45 ConsoleKit
-rw------- 1 root root 0 Jun 7 03:22 cron
-rw-------. 1 root root 0 May 10 03:06 cron-20200517
-rw-------. 1 root root 0 May 17 03:18 cron-20200524
-rw-------. 1 root root 0 May 24 04:28 cron-20200531
-rw------- 1 root root 0 May 31 03:37 cron-20200607
-rw-r--r-- 1 root root 72278 Jun 2 12:34 dmesg
-rw-r--r-- 1 root root 72278 May 30 11:22 dmesg.old
drwx------ 2 root root 4096 Jun 9 08:18 earch
drwxr-xr-x. 2 nagios nagios 4096 Jun 3 03:45 elasticsearch
drwx------. 2 root root 4096 Apr 24 00:57 erver.jar
drwx------. 2 root root 4096 Jun 7 03:22 httpd
drwx------. 2 root root 4096 Apr 7 2019 keywordTab
-rw-r--r--. 1 root root 308352 Jun 11 11:01 lastlog
drwxr-xr-x. 2 nagios nagios 4096 Jun 3 03:45 logstash
drwxr-xr-x. 2 root root 4096 Jul 12 2016 mail
-rw------- 1 root root 0 Jun 7 03:22 maillog
-rw-------. 1 root root 0 May 10 03:06 maillog-20200517
-rw-------. 1 root root 0 May 17 03:18 maillog-20200524
-rw-------. 1 root root 0 May 24 04:28 maillog-20200531
-rw------- 1 root root 0 May 31 03:37 maillog-20200607
-rw------- 1 root root 0 Jun 7 03:22 messages
-rw-------. 1 root root 0 May 10 03:06 messages-20200517
-rw-------. 1 root root 0 May 17 03:18 messages-20200524
-rw-------. 1 root root 0 May 24 04:28 messages-20200531
-rw------- 1 root root 0 May 31 03:37 messages-20200607
drwx------. 2 root root 4096 Apr 29 08:39 nstruction
drwx------. 2 root root 4096 Jun 5 12:02 prodwebseal1.mazdausa.com
drwx------. 2 root root 4096 Jul 10 2019 prodwebseal2
drwx------. 2 root root 4096 Jun 10 02:20 prodwebseal2.mazdausa.com
drwx------. 2 root root 4096 Jun 4 17:50 prodwebseal3.mazdausa.com
drwx------. 2 root root 4096 Jun 8 06:20 prodwebseal4.mazdausa.com
-rw------- 1 root root 0 Jun 7 03:22 secure
-rw-------. 1 root root 0 May 10 03:06 secure-20200517
-rw-------. 1 root root 0 May 17 03:18 secure-20200524
-rw-------. 1 root root 0 May 24 04:28 secure-20200531
-rw------- 1 root root 0 May 31 03:37 secure-20200607
-rw------- 1 root root 0 Jun 7 03:22 spooler
-rw-------. 1 root root 0 May 10 03:06 spooler-20200517
-rw-------. 1 root root 0 May 17 03:18 spooler-20200524
-rw-------. 1 root root 0 May 24 04:28 spooler-20200531
-rw------- 1 root root 0 May 31 03:37 spooler-20200607
drwx------. 2 root root 4096 May 21 2019 -This
drwx------. 2 root root 4096 Oct 17 2018 --This
drwx------. 2 root root 4096 Apr 22 11:22 unconfigured
drwxr-xr-x. 3 root root 4096 Apr 28 21:14 vmware-caf
-rw-r--r--. 1 root root 3934 May 3 2018 vmware-install.log
-rw-r--r--. 1 root root 33746 Jun 2 12:34 vmware-vgauthsvc.log.0
-rw-r--r--. 1 root root 70901 Jun 9 15:09 vmware-vmsvc.log
-rw-rw-r--. 1 root utmp 77952 Jun 11 11:01 wtmp
drwx------. 2 root root 4096 Jun 11 17:40
-rw-------. 1 root root 1438 Jun 11 17:42 yum.log
-rw-------. 1 root root 330 Oct 30 2018 yum.log-20190101
total 120
drwxr-xr-x. 18 root root 4096 Jun 11 17:42 .
drwxr-xr-x. 18 root root 4096 Dec 21 2015 ..
-rw-r--r-- 1 root root 5 Jun 2 12:34 auditd.pid
drwxr-xr-x. 2 root root 4096 Mar 22 2017 console
drwxr-xr-x. 2 root root 4096 May 10 2016 ConsoleKit
-rw-r--r-- 1 root root 5 Jun 2 12:34 crond.pid
---------- 1 root root 0 Jun 2 12:34 cron.reboot
-rw-r----- 1 root root 4 Jun 2 12:34 cylancesvc.pid
drwxr-xr-x. 2 root root 4096 Jun 2 12:34 dbus
drwxr-xr-x. 2 nagios nagios 4096 Jun 11 17:42 elasticsearch
drwxr-xr-x. 2 root root 4096 Jun 2 12:34 faillock
drwx--x---. 2 root apache 4096 Jun 11 17:40 httpd
drwxr-xr-x. 2 nagios nagios 4096 Jun 11 18:16 logstash
drwx------. 2 root root 4096 Mar 22 2017 lvm
-rw-r--r-- 1 root root 5 Jun 2 12:34 messagebus.pid
drwxrwxr-x. 2 root root 4096 May 30 2017 netreport
drwxr-xr-x. 2 root root 4096 Mar 22 2017 net-snmp
-rw-r--r-- 1 root root 4 Jun 2 12:34 ntpd.pid
drwxr-xr-x. 2 root root 4096 Mar 21 2017 plymouth
drwxr-xr-x. 2 root root 4096 Mar 25 2015 saslauthd
drwxrwxr-x. 2 root screen 4096 Nov 9 2017 screen
-rw------- 1 root smmsp 33 Jun 2 12:34 sendmail.pid
drwxr-xr-x. 2 root root 4096 Mar 22 2017 sepermit
drwxr-xr-x. 2 root root 4096 May 10 2016 setrans
-rw-r--r-- 1 smmsp smmsp 49 Jun 2 12:34 sm-client.pid
-rw-r--r-- 1 root root 5 Jun 2 12:34 sshd.pid
-rw------- 1 root root 6 Jun 3 16:26 syslogd.pid
-rw-rw-r-- 1 root utmp 4608 Jun 11 11:01 utmp
-rw-r--r-- 1 root root 5 Jun 2 12:34 vmtoolsd.pid
drwxr-xr-x. 2 root root 4096 Jun 2 12:34 vmware

Please PM me a copy of your profile, you can download it from Admin > System Status by clicking the Download System Profile button.

Have you tried rebooting the system?

You can also try this:
What do these commands output?

Yes rebooted system and executed restart of logstash, No luck,

ps aux |grep logstash
root 5136 0.0 0.0 130736 1392 pts/0 SN+ Jun02 0:00 runuser -s /bin/sh -c exec /usr/local/nagioslogserver/logstash/bin/logstash agent -f /usr/local/nagioslogserver/logstash/etc/conf.d --verbose nagios
nagios 5137 16.6 1.6 2896740 1063256 ? SNsl Jun02 2405:28 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xss2048k -Djffi.boot.library.path=/app/nagioslogserver/logstash/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/usr/local/nagioslogserver/logstash/heapdump.hprof -Xbootclasspath/a:/app/nagioslogserver/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/app/nagioslogserver/logstash/vendor/jruby -Djruby.lib=/app/nagioslogserver/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /usr/local/nagioslogserver/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /usr/local/nagioslogserver/logstash/etc/conf.d --verbose
root 5170 0.0 0.0 103324 884 pts/2 S+ 13:17 0:00 grep logstash

netstat -anop | grep 3515
tcp 0 0 :::3515 :::* LISTEN 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:0760 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:2033 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:3968 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:1467 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:4421 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:9146 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:2204 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******3515 ::ffff:*******:58 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:59472 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:55215 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:62002 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:54882 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:53171 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:52577 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:63966 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:60535 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:59171 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:58932 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:4048 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:57743 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:56827 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:59911 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:61142 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:54038 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:55493 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:64667 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:60318 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:65458 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:57538 ESTABLISHED 5137/java off (0.00/0/0)
tcp 0 0 ::ffff:*******:3515 ::ffff*******:56875 ESTABLISHED 5137/java off (0.00/0/0)

Attached.

Try this:

Tried this still no luck.

service logstash status
Logstash Daemon dead but pid file exists

Could you please help with any update?

Please provide me a copy of the /etc/init.d/logstash file from the system. I've also attached a copy here that I'd like you to test with(remove the .txt extension). Once it is copied over, make sure the permissions are set:
and run it:
and provide the results.

Please also confirm the OS that NLS is installed on.