Customized Logstash configuration for the existing LS service but process still showing the default path /etc/logstash, also, getting Warning: no jvm.options file found and WARNING: Could not find logstash.yml which is typically located in $LS_HOME/confi

Elastic Stack Logstash
1

Friends, I did modify logstash configuration and setting files to my desired path, then, I am able to run logstash service up and running. However, I can see default path /etc/logstash in the output of "ps -ef | grep logstash". But there is no such logstash folder in /etc directory. Surprisingly, "ps -ef" command output still showing default path /etc/logstash.

Not sure, why process "ps" command throwing the result with default path when there is no such logstash folder under /etc.

**

Any thoughts please?

**

Here is out put of ps command.

ps -ef | grep logstash

logstash 17994 1 99 16:21 ? 00:00:11 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Dlog4j2.isThreadContextMapInheritable=true -Dlogstash.jackson.stream-read-constraints.max-string-length=200000000 -Dlogstash.jackson.stream-read-constraints.max-number-length=10000 -Djruby.regexp.interruptible=true -Djdk.io.File.enableADS=true --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio.channels=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/sun.management=ALL-UNNAMED -Dio.netty.allocator.maxOrder=11 -cp /usr/share/logstash/vendor/jruby/lib/jruby.jar:/usr/share/logstash/logstash-core/lib/jars/checker-qual-3.42.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.17.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-logging-1.3.1.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.26.1.jar:/usr/share/logstash/logstash-core/lib/jars/failureaccess-1.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.22.0.jar:/usr/share/logstash/logstash-core/lib/jars/guava-33.1.0-jre.jar:/usr/share/logstash/logstash-core/lib/jars/httpclient-4.5.14.jar:/usr/share/logstash/logstash-core/lib/jars/httpcore-4.4.16.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.16.2.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/javassist-3.30.2-GA.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-3.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/jvm-options-parser-8.17.4.jar:/usr/share/logstash/logstash-core/lib/jars/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-jcl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.2.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/reflections-0.10.2.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.32.jar:/usr/share/logstash/logstash-core/lib/jars/snakeyaml-2.2.jar org.logstash.Logstash --path.settings /etc/logstash

2

Some more details from journalctl -u logstash command

-- Logs begin at Thu 2025-07-24 03:30:59 UTC, end at Thu 2025-07-24 05:32:36 UTC. --
Jul 24 03:31:03 ip-.eu-central-1.compute.internal systemd[1]: Started logstash.
Jul 24 03:31:03 ip-.eu-central-1.compute.internal logstash[754]: Using bundled JDK: /usr/share/logstash/jdk
Jul 24 03:31:04 ip-.eu-central-1.compute.internal logstash[781]: Warning: no jvm.options file found.
Jul 24 03:31:18 ip-.eu-central-1.compute.internal logstash[754]: WARNING: Could not find logstash.yml which is typically located in $LS_HOME/confi
g or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Jul 24 03:31:18 ip-.eu-central-1.compute.internal logstash[754]: Could not find log4j2 configuration at path /etc/logstash/log4j2.properties. Usin
g default config which logs errors to the console

3

Did you edit the logstash service?

This path is defined in the logstash service file, where you have a line like this:

ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"