# Can't run Logstash as a Service

**URL:** <https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202>\
**Category:** Logstash\
**Created:** [March 9, 2022, 11:13am UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202 "2022-03-09T11:13:44Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 9, 2022, 11:13am UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/1 "2022-03-09T11:13:44Z")

</div>

If i run logstash manually it works fine and sends all data in the right way.

But when i try to run it as a service it shows this error:

 ![Errore logstash as a service](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96bb32c2261353e76242618a576112537851e61c.png)

Cmd that i use: sudo systemctl start logstash.service  
OS Ubuntu 20.04.1  
Logstash version: 7.9.2

Pls help me, i need tofix it quickly

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 9, 2022, 6:13pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/2 "2022-03-09T18:13:13Z")

</div>

You need to show us the logstash logs, possibly in /var/log/logstash.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 9, 2022, 6:33pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/3 "2022-03-09T18:33:05Z")

</div>

It doesn't generate any new log ☹

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 9, 2022, 6:34pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/4 "2022-03-09T18:34:37Z")

</div>

You need to share your system logs as well.

Look at `/var/log/messages` or `/var/log/syslog` when you tried to start the logstash service to see why it was not able to start.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 9, 2022, 6:37pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/5 "2022-03-09T18:37:19Z")

</div>

It doesn't generate any new log

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 9, 2022, 6:39pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/6 "2022-03-09T18:39:43Z")

</div>

Should be something in `/var/log/messages` for Red Hat based distributions or `/var/log/syslog` for Debian based distributions.

Try to run `sudo systemctl start logstash` and check one of those files, without seeings logs of the system is not possible to know what is happening.

Also check the permissions to the `/var/log/logstash` folder to see if the `logstash` user has permissions to write on this folder.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 1:45pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/7 "2022-03-10T13:45:29Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/f/df613b58d8b0eabb3b12395b2b8f2252fc7db659.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 1:47pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/8 "2022-03-10T13:47:54Z")

</div>

There is your error, logstash could not find `java`.

You will need to install java or set `JAVA_HOME` for the logstash processs.

You could also update to a newer version, starting with version `7.10` logstash now has a bundled java, but version `7.9` does not, so you need a java installation.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 1:50pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/9 "2022-03-10T13:50:33Z")

</div>

i already have java,in:  
java: /usr/bin/java /usr/share/java /usr/lib/jvm/java-11-oracle/bin/java

Where i set JAVA\_HOME?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 1:54pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/10 "2022-03-10T13:54:42Z")

</div>

What the following command returns?

```auto
sudo -u logstash which java

```

This will tell you if the logstash user, the one that runs the service, can find the `java` binary in your system.

You could also add the variable into the file `/etc/default/logstash` or `/etc/sysconfig/logstash` depending on the distribution of your system.

You would need to add a line like this:

```auto
JAVA_HOME=/path/to/java/home

```

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 1:58pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/11 "2022-03-10T13:58:25Z")

</div>

If i lunch the command it doesn't give something in return

I use Ubuntu 20.04.1, so i need to modify /etc/default/logstash, right?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 2:03pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/12 "2022-03-10T14:03:32Z")

</div>

If the command does not return anything, than the `logstash` user can not find java in your system, that's the reason you cannot start the service.

You could add the variable to the `/etc/default/logstash`, but it would be better if you just upgrade the logstash to a new version as it already has a bundled jdk.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 2:23pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/13 "2022-03-10T14:23:36Z")

</div>

I tried to start and nothing arrivied in Kibana, i looked at syslog and i found this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e6b5252db68204a08dbbe98d74b9bb2604a3e69.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d704c98f44f1031ce7d0e81ddb70621acf4cef16.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35f84270482c51356d725ca83e213d6323236d28.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e239b6f435f3b526dc48c3aab4f0dc5447e3cfeb.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 2:28pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/14 "2022-03-10T14:28:06Z")

</div>

Please, do not share screenshot of log messages, just copy the plain text and share it using the preformatted text button `</>`.

It is really hard to see error logs on screenshots and is not possible to search on them.

Your error is pretty clear, the `logstash` user does not have permission to write in the directory `/var/log/logstash`, so it can't create the log file.

Change the permission to the directory

```auto
sudo chown logstash:logstash /var/log/logstash

```

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 2:38pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/15 "2022-03-10T14:38:39Z")

</div>

i have the same error after using the command sudo chown

```auto
main ERROR RollingFileManager (/var/log/logstash/logstash-plain.log) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied) java.io.FileNotFoundException: /var/log/logstash/logstash-plain.log (Permission denied)

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 2:40pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/16 "2022-03-10T14:40:10Z")

</div>

Did you tried to run logstash before as the root user? If you did it would create the file with the root user as the owner.

Just remove the file and start the service again.

```auto
sudo rm /var/log/logstash/logstash-plain.log

```

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 2:46pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/17 "2022-03-10T14:46:20Z")

</div>

I only run logstash manually before, as root

Now i have this:

```auto
[ERROR][org.logstash.execution.AbstractPipelineExt] Logstash failed to create queue.

```

```auto
[ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalStateException", :message=>"java.nio.file.AccessDeniedException: /usr/share/logstash/queue_data/main/.lock", :backtrace=>["org.logstash.execution.AbstractPipelineExt.openQueue(AbstractPipelineExt.java:204)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$0$0$openQueue.call(AbstractPipelineExt$INVOKER$i$0$0$openQueue.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:831)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:45)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$ __VARARGS__ (/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.base/java.lang.Thread.run(Thread.java:834)"]}
Mar 10 15:42:41 lnx01bigdata logstash[140667]: warning: thread "Converge PipelineAction::Create<main>" terminated with exception (report_on_exception is true):

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 2:55pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/18 "2022-03-10T14:55:03Z")

</div>

> [@Simone1](#):
>
> I only run logstash manually before, as root

That's the issue, when you run it as the root user, it creates a couple of files owned by the root user, mainly the log file and some files if you are using persistent queues, which seems your issue now.

You will need to remove or change the permission of those files created when you run it as a root, check the log, see what file it says that it does not have permission and delete or change the permissions to the logstash user.

---

<div class="post-metadata">

**Author:** ![Simone1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simone1/32/97834_2.png) [@Simone1](https://discuss.elastic.co/u/Simone1)\
**Post date:** [March 10, 2022, 2:58pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/19 "2022-03-10T14:58:48Z")

</div>

could be this?

```auto
java.nio.file.AccessDeniedException: /usr/share/logstash/queue_data/main/.lock

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 2:59pm UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202/20 "2022-03-10T14:59:49Z")

</div>

Yes, check the description of the error _AccessDeniedException_, this means that logstash could not access this file, so you need to change it permissions to the logstash user.

[Next page](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202.md?page=2)