log4j warning when run from 2.4

[ph]

When you start the plugin in 2.4 we get a warning.

rclarke@es-rclarke:100456$ ~/elastic/stack/logstash-2.4.0/bin/logstash agent --config ./logstash.conf --log ./logstash.log --quiet
Sending logstash logs to ./logstash.log.
Settings: Default pipeline workers: 4
log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

[ph]

I believe #130 fixed the issue

[ph]

confirmed that the #130 PR fixed that issue

[robin13]

It seems that this has come back in version 3.1.8 of the plugin (deployed with Logstash 2.4.1)

input {
    beats {
        port => 12345
    }
}

output {
    stdout {
    }
}

results in

log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
Settings: Default pipeline workers: 4

[ph]

confirmed its back :(

ph@sashimi~/Downloads/logstash-2.4.1 bin/logstash -e 'input { beats { port => 6000 }}'
    log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
Settings: Default pipeline workers: 4
Pipeline main started

[renevdm]

It seems like the error is back again:

# service logstash configtest
log4j:WARN No appenders could be found for logger (io.netty.util.internal.logging.InternalLoggerFactory).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
Configuration OK

No events flow into elasticsearch via logstash. But when I disable all beats inputs, the error messages disappear and events do flow into elasticsearch.

[ph]

@renevdm It's a warning, it shouldn't affect the receiving of events?

The problem is the log4j bridge api was removed from the logstash-core https://github.com/elastic/logstash/commit/8dfefad58a1d5257016b1225994abfed2306d8ca

The plugin need to be shipped with the bridge to correctly record log.

[renevdm]

Yes it's a warning, but when running logstash with beats inputs enabled, logstash stops handling all events. Even stopping logstash doesn't work anymore, it looks like it is really stuck, but shows no errors in the log files. Only way to stop logstash is using a dirty "kill -9"

[ph]

@renevdm let's open a new issue with your problem and keep the log4j issue in this one.

[renevdm]

Ok, seems fair to me :)

[renevdm]

Opened this one: https://github.com/logstash-plugins/logstash-input-beats/issues/193