🚨 Logstash Error: 'Logstash stopped processing because of an error: (SystemExit)' — Cause, Fix, and Troubleshooting Guide

What this error means

When Logstash aborts during startup it unwinds by calling exit, and that call surfaces as a SystemExit at the very top of the log. The two FATAL lines look like this in /var/log/logstash/logstash-plain.log:

[FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<SystemExit: exit>, :backtrace=>["org/jruby/RubyKernel.java:...", "..."]}
[FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit

The critical thing to understand is that (SystemExit) exit is a wrapper, not the cause. It only tells you that Logstash decided to shut down — something earlier in the boot sequence already failed and triggered the exit. The real error is on the lines above this FATAL. Chasing SystemExit itself is a dead end; the fix is always found by scrolling up to the first ERROR in the same startup.

How the agent reports it

• The service never reaches a running state: systemctl status logstash shows activating (auto-restart) or failed, cycling repeatedly.
• The last lines of the log are the two FATAL entries ending in (SystemExit) exit.
• No pipeline ever starts — you never see Pipeline started or Successfully started Logstash API endpoint.
• One or more ERROR lines appear shortly before the FATAL, naming the true problem (bad YAML, unwritable directory, missing config).
• On a systemd box the unit keeps restarting on the same error until you fix the underlying cause.

Checking the agent configuration

Ignore the SystemExit line and go straight to the first error above it. That single grep usually names the real cause:

sudo grep -nE 'ERROR|FATAL' /var/log/logstash/logstash-plain.log | tail -n 20

Validate logstash.yml as YAML — a bad indent or stray tab is the most common trigger:

ruby -ryaml -e 'YAML.load_file("/etc/logstash/logstash.yml") && puts "YAML OK"'
# or, if available:
yamllint /etc/logstash/logstash.yml

A healthy logstash.yml uses two-space indentation and no tabs:

node.name: logstash-01
path.data: /var/lib/logstash
path.logs: /var/log/logstash
pipeline.workers: 4

Confirm the data and log directories are owned by and writable by the service user:

sudo -u logstash test -w /var/lib/logstash && echo "path.data writable" || echo "path.data NOT writable"
ls -ld /var/lib/logstash /var/log/logstash

Then run Logstash’s own config test, which exercises settings and pipeline parsing without starting ingestion:

sudo -u logstash /usr/share/logstash/bin/logstash -t --path.settings /etc/logstash

Agent configuration causes

• Invalid logstash.yml — a YAML syntax error, bad indentation, or a tab character makes the settings file unparseable, so Logstash exits at boot.
• Unwritable path.data or path.logs — the directory is not owned by, or writable by, the logstash user, so Logstash cannot create its data/lock files and aborts.
• Broken pipelines.yml — malformed YAML or a path.config pointing at a directory with no config files.
• No configuration found — no pipeline config exists at the expected path, so there is nothing to run.
• A plugin or setting that calls exit — an incompatible plugin or an invalid setting value that fails validation during startup.

Step-by-step resolution

Fix whatever the preceding ERROR named. If it was logstash.yml, correct the YAML — replace tabs with spaces and align keys — then re-validate:

ruby -ryaml -e 'YAML.load_file("/etc/logstash/logstash.yml") && puts "YAML OK"'

If path.data or path.logs was not writable, restore ownership to the logstash user and retry:

sudo chown -R logstash:logstash /var/lib/logstash /var/log/logstash
sudo chmod -R u+rwX /var/lib/logstash

If pipelines.yml was the culprit, make sure each entry has a valid path.config that resolves to real files:

- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

After correcting the root cause, run the config test once more, then restart the service and confirm it stays up:

sudo -u logstash /usr/share/logstash/bin/logstash -t --path.settings /etc/logstash
sudo systemctl restart logstash && sudo systemctl status logstash --no-pager

Safer agent defaults

• Do not treat (SystemExit) exit as the error — it is only the shutdown wrapper. The actionable message is always one or more lines above it.
• YAML is whitespace-sensitive: a single tab or a misaligned key in logstash.yml or pipelines.yml is enough to abort startup, and the message can be terse.
• Always run the config test as the logstash user (sudo -u logstash), not root — running as root can mask permission problems that only bite the service user.
• After a package upgrade, re-check directory ownership; upgrades occasionally reset permissions on path.data.
• Because systemd auto-restarts on failure, a broken config can loop silently — watch journalctl -u logstash -f during the fix so you see it settle into a running state.

Related agent errors

• No configuration found
• Logstash could not be started — another instance lock
• Pipeline aborted due to error