logstash unable to run as a service

Question

I've recently installed logstash via the apt package repositories here: https://www.elastic.co/guide/en/logstash/current/package-repositories.html

I have also created my own configuration file, which processes some syslog-ng logs and parses them accordingly.

The issue is that for me to make logstash use that configuration file, I have to manually do it using the following command (while in the logstash directory):

bin/logstash -f logstash.conf

I've tried using a variety of init scripts such as the one shown here: https://gist.github.com/nodesocket/5941884 with no luck. Whenever I attempt to check the status of logstash ("sudo service logstash status"), I get the "logstash started" message but when I check again it says "logstash is not running".

I was just looking for a step by step guide on how to get it working from a fresh installation of logstash.

Answer 1

In /var/log/logstash/ there should be a set of logstash logs. Try looking through those to see what the actual error was.

Answer 2

• I assume your logstash.conf file is working:
• you can check with this command:
  bin/logstash -f logstash.conf --configtest
• So may be problem is your permission to logstash service.
  I mean, because you want to parse syslog logs, and syslog logs come from default 514 port which needs root permission.
  In order to give permission to your logstash service you should change in your logstash.yml file
  LS_USER=logstash to LS_USER=root
• I don't know your problem is that or not, but may be it can be helpful.

Answer 3

I have the same problem before in Ubuntu 16.0.4. Maybe your problem was for java! I have installed java manually in /usr/local/java/.... but logstash by default read /usr/bin/java to use java.

check it with this command:

root@elk:~# which java
/usr/bin/java

if the result not /usr/bin/java do the following instruction:

wget http://url to jdk****.tar.gz
sudo mkdir /usr/lib/jvm
cd /usr/lib/jvm
sudo tar -xvzf ~/Downloads/jdk********.tar.gz
vi /etc/environment

Add this line to environment

PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/usr/lib/jvm/jdk1.8.0_151/bin:/usr/lib/jvm/jdk1.8.0_151/db/bin:/usr/lib/jvm/jdk1.8.0_151/jre/bin"
J2SDKDIR="/usr/lib/jvm/jdk1.8.0_151"
J2REDIR="/usr/lib/jvm/jdk1.8.0_151/jre"
JAVA_HOME="/usr/lib/jvm/jdk1.8.0_151"
DERBY_HOME="/usr/lib/jvm/jdk1.8.0_151/db"

then save it and close. after that run this commands:

sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk1.8.0_151/bin/java" 0 
sudo update-alternatives --install "/usr/bin/javac" "javac" "/usr/lib/jvm/jdk1.8.0_151/bin/javac" 0 
sudo update-alternatives --set java /usr/lib/jvm/jdk1.8.0_151/bin/java 
sudo update-alternatives --set javac /usr/lib/jvm/jdk1.8.0_151/bin/javac


reboot