🚨 Logstash Error Guide: 'No configuration found in the configured sources' — Fix path.config and pipelines.yml

Overview

Logstash refuses to start a pipeline that has no configuration to run. When the configured source resolves to zero pipeline files, startup fails with:

[ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[FATAL][logstash.runner] Logstash could not be started because it failed to load
the configuration. No configuration found in the configured sources.

“Configured sources” means either the path.config/-f you passed on the command line, or the pipelines declared in pipelines.yml. If neither yields at least one readable, non-empty .conf, Logstash has nothing to build a pipeline from and exits.

Symptoms

• Logstash exits immediately at boot with the sourceloader error and a FATAL runner line.
• The service was working, then a config was moved, renamed, or its directory changed and it stopped booting.
• Running bin/logstash -f /path/that/exists still fails because the glob matched nothing.
• A brand-new install starts, prints the error, and stops — no pipeline was ever configured.
• pipelines.yml and command-line -f conflict, and Logstash silently ignores one.

Common Root Causes

• path.config points nowhere useful — a typo, a wrong directory, or a glob like /etc/logstash/conf.d/*.conf in a directory that only has .conf.disabled files.
• Files present but empty — a zero-byte .conf or a directory of comments counts as “no configuration”.
• pipelines.yml vs -f collision — starting with -f while pipelines.yml is the active source (or vice-versa); you cannot use both, and one wins.
• Permissions — the logstash service user cannot read the config directory or files (root-owned 600 files).
• Wrong extension or glob — files named .config while the glob expects *.conf, or a recursive glob that does not match the layout.
• Container mount missing — the config volume was not mounted, so the path is empty inside the container.

Diagnostic Workflow

Determine which source Logstash is actually using. If you launch via systemd, it uses pipelines.yml; a bare bin/logstash needs -f:

grep -E '^\s*path.config|^\s*config.string' /etc/logstash/logstash.yml
cat /etc/logstash/pipelines.yml
systemctl cat logstash | grep -E 'ExecStart'

Expand the glob by hand as the service user to prove files actually match:

sudo -u logstash bash -c 'ls -la /etc/logstash/conf.d/*.conf'
sudo -u logstash bash -c 'find /etc/logstash/conf.d -name "*.conf" -size +0c'

Check pipelines.yml really points at existing paths:

# /etc/logstash/pipelines.yml
- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"   # must glob to >= 1 non-empty file

Validate the configuration explicitly with the config test flag, which reports exactly what it loaded:

sudo -u logstash /usr/share/logstash/bin/logstash \
  --path.settings /etc/logstash -t
# Or test a single file directly:
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/main.conf --config.test_and_exit

Rule out permissions on both the directory and the files:

sudo ls -la /etc/logstash/conf.d/
namei -l /etc/logstash/conf.d/main.conf

Once a config loads, confirm the pipeline started and reaches Elasticsearch:

curl -s localhost:9600/_node/pipelines?pretty | grep pipeline
curl -s 'http://es:9200/_cat/indices/logstash-*?v'

Example Root Cause Analysis

After a configuration-management refactor, a team moved their pipeline files from /etc/logstash/conf.d/ into /etc/logstash/pipelines/apache/ but forgot to update pipelines.yml, which still read path.config: "/etc/logstash/conf.d/*.conf". The old directory was now empty, so the glob matched zero files and every boot failed with No configuration found in the configured sources.

Running sudo -u logstash ls -la /etc/logstash/conf.d/*.conf returned No such file or directory — the smoking gun. The glob was pointed at an empty directory. They updated pipelines.yml to path.config: "/etc/logstash/pipelines/apache/*.conf", ran logstash -t to confirm the pipeline compiled, and restarted. The _node/pipelines API then showed the apache pipeline active and documents began flowing to Elasticsearch again.

Prevention Best Practices

• Standardize on one source: use pipelines.yml for production (it scales to many pipelines) and never mix it with command-line -f in the service unit.
• Always run logstash -t (config test) in CI or a pre-deploy hook so a missing or empty config is caught before it reaches a node.
• Keep pipeline files owned by and readable by the logstash user; avoid root-owned 600 configs.
• Use absolute, explicit globs in pipelines.yml and verify them with find ... -size +0c after any directory move.
• In containers, assert the config volume is mounted (fail the readiness check if path.config is empty) rather than starting into an empty directory.
• Version-control the config tree so directory renames update the referencing pipelines.yml in the same change.

Quick Command Reference

# Which source is Logstash using?
cat /etc/logstash/pipelines.yml
systemctl cat logstash | grep ExecStart

# Prove the glob matches real, non-empty files (as the service user)
sudo -u logstash bash -c 'find /etc/logstash/conf.d -name "*.conf" -size +0c'

# Validate configuration without starting
sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t

# Permissions along the whole path
namei -l /etc/logstash/conf.d/main.conf

# Confirm the pipeline came up
curl -s localhost:9600/_node/pipelines?pretty | grep pipeline

Conclusion

No configuration found in the configured sources means Logstash’s configured source resolved to zero usable pipeline files. Identify which source is active — pipelines.yml for a service, -f for an ad-hoc run — then expand the glob as the logstash user to confirm at least one non-empty, readable .conf matches. The common traps are moved directories, empty files, .conf extension mismatches, permissions, and mixing -f with pipelines.yml. Add a logstash -t config test to your deploy pipeline and this error never reaches production.