🚨 Logstash Error: 'Could not create the Java Virtual Machine' — Cause, Fix, and Troubleshooting Guide

Overview

Before Logstash gets anywhere near a pipeline, it has to launch a JVM using the flags in /etc/logstash/jvm.options. If the JVM rejects any of those flags, it refuses to start and Logstash never boots. This fails so early that the message goes to the console / journalctl rather than logstash-plain.log:

Unrecognized VM option 'UseConcMarkSweepGC'
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.

You may instead see a heap-sizing variant of the same class of failure:

Invalid initial heap size: -Xms

In both cases the JVM is telling you a line in jvm.options is not acceptable to this JDK. The most common trigger after an upgrade to Logstash 8 is a deprecated garbage-collector flag: the bundled JDK removed old GC options, so a config carried over from an older Logstash aborts the launch.

Symptoms

• Logstash exits immediately on start; systemctl status logstash shows failed with a non-zero exit and no pipeline activity.
• journalctl -u logstash (or the terminal, if run by hand) shows Unrecognized VM option ... or Could not create the Java Virtual Machine.
• logstash-plain.log is empty or unchanged for this attempt — the process died before logging initialized.
• The failure started right after upgrading Logstash (7.x → 8.x), editing jvm.options, or changing LS_JAVA_HOME/JAVA_HOME.
• A heap variant reads Invalid initial heap size or Invalid maximum heap size, pointing at a malformed -Xms/-Xmx value.

Common Root Causes

• Deprecated GC flag — UseConcMarkSweepGC (CMS) and UseParNewGC were removed in the JDK generations bundled with Logstash 8 (JDK 14 and later). A carried-over flag makes the JVM abort with Unrecognized VM option.
• -Xmx larger than available RAM — asking for more heap than the box has causes the JVM to fail to create.
• Malformed heap value — a stray or empty value like -Xms with no size, or mismatched units, produces Invalid initial heap size.
• Wrong external JDK — LS_JAVA_HOME/JAVA_HOME points at an incompatible system JDK instead of the JDK bundled with Logstash, and that JDK rejects Logstash’s default flags.
• Duplicated or conflicting options — the same flag set twice with different values, or a copy-paste that left in an option the current JDK does not know.

How to diagnose

Read the exact rejected option from the boot log — the JVM names it precisely:

sudo journalctl -u logstash -n 40 --no-pager | grep -Ei 'VM option|Java Virtual Machine|heap size'

Inspect the active heap and GC settings in /etc/logstash/jvm.options. This file uses one option per line; comments start with #:

-Xms2g
-Xmx2g
## deprecated in the bundled JDK — this line aborts startup:
-XX:+UseConcMarkSweepGC

Check which JDK Logstash will actually use. If LS_JAVA_HOME is set, it overrides the bundled JDK:

systemctl show logstash -p Environment | tr ' ' '\n' | grep -Ei 'LS_JAVA_HOME|JAVA_HOME'
sudo /usr/share/logstash/bin/logstash --version

Confirm the box actually has the RAM you are requesting for the heap:

free -h

Fixes

Edit /etc/logstash/jvm.options: remove deprecated flags, keep -Xms and -Xmx equal, and size the heap within physical RAM (a common baseline is 2g, and generally no more than half the machine’s memory). A corrected file looks like:

## JVM heap — keep min and max equal, within available RAM
-Xms2g
-Xmx2g

## Let the bundled JDK use its default modern GC (G1) — do NOT set CMS/ParNew
-Dfile.encoding=UTF-8
-Djava.awt.headless=true

Prefer the JDK bundled with Logstash by unsetting any external override, so you are not fighting an incompatible system JDK:

sudo systemctl edit logstash   # remove/blank LS_JAVA_HOME and JAVA_HOME from the unit
# then confirm which JDK is picked up:
sudo /usr/share/logstash/bin/logstash --version

Verify free memory before committing to a heap size, then restart and confirm the JVM comes up:

free -h
sudo systemctl restart logstash && sudo systemctl status logstash --no-pager

What to watch out for

• After a major Logstash upgrade, treat jvm.options as suspect — GC and diagnostic flags that were valid in the old bundled JDK may be removed in the new one.
• Always keep -Xms equal to -Xmx; unequal or unset values cause both performance churn and, when malformed, Invalid initial heap size.
• Do not oversize the heap. More than ~half of RAM (or above the ~30–32 GB compressed-oops threshold) hurts rather than helps and can prevent the JVM from starting on smaller boxes.
• If you must use an external JDK, make sure it matches the version Logstash supports; otherwise unset LS_JAVA_HOME and let the bundled JDK win.
• Because this failure happens before logging initializes, always look in journalctl/console output — not logstash-plain.log — when Logstash dies instantly at startup.

Related

• Java heap space (OutOfMemoryError)
• Logstash could not be started — another instance lock
• No configuration found