# HELP - Logstash isn't working!

**URL:** <https://discuss.elastic.co/t/help-logstash-isnt-working/80614>\
**Category:** Logstash\
**Created:** [March 30, 2017, 8:01am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614 "2017-03-30T08:01:10Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [March 30, 2017, 8:01am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/1 "2017-03-30T08:01:10Z")

</div>

Hey guys, ,

I'm in the process of installing Logstash, but I'm stuck halfway.

This is what's happening:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/3/93e6a8522712fe4e9d6c868f1f7b609f7bd6fb30.png) ![](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5f4344008f7015cd5877d69a35f90b1c7a445090.png)

What am I supposed to do?  
I really need to install it ASAP.

Thanks,  
Safa

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 8:01am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/2 "2017-03-30T08:01:54Z")

</div>

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them. 🙂

Why don't you run the latest?

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [March 30, 2017, 8:03am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/3 "2017-03-30T08:03:48Z")

</div>

Oh sorry, but I highlighted the errors appearing 🙂

I installed Kibana and ES version 5.2.2, so I really don't want to update everything all over again. 😕

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 8:04am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/4 "2017-03-30T08:04:41Z")

</div>

Why do you need to update everything, just use a more recent version of LS.

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [March 30, 2017, 8:05am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/5 "2017-03-30T08:05:44Z")

</div>

But isn't everything supposed to be the same version?

I'm not sure if installing LS 5.3 will fix this problem, though.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 8:06am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/6 "2017-03-30T08:06:37Z")

</div>

Your URL shows you are trying to install 2.2?

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [March 30, 2017, 8:08am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/7 "2017-03-30T08:08:46Z")

</div>

Yeah, I just typed 'sudo apt-get install logstash' and it showed that it's trying to install 2.2.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 8:09am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/8 "2017-03-30T08:09:50Z")

</div>

Right, that's my point.

I'd suggest you check your repository settings - [https://www.elastic.co/guide/en/logstash/current/installing-logstash.html#package-repositories](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html#package-repositories)

---

<div class="post-metadata">

**Author:** ![rayl7786](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rayl7786](https://discuss.elastic.co/u/rayl7786)\
**Post date:** [March 30, 2017, 1:36pm UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/9 "2017-03-30T13:36:33Z")

</div>

Yea, as stated earlier, it looks like the repository definition is incorrect. Below should be the one to add to /etc/apt/sources.list or create your own file under /etc/apt/sources.list.d/

deb [https://artifacts.elastic.co/packages/5.x/apt](https://artifacts.elastic.co/packages/5.x/apt) stable main

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [April 1, 2017, 7:59am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/10 "2017-04-01T07:59:18Z")

</div>

Thanks a lot guys, I passed the point where I was stuck.  
But now I'm stuck elsewhere...

It says Logstash is already running, then it says file doesn't exist.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b38f85e1625bc6ebc7d92ba477c6b8b3f672bd8.png)

Sooo weird....

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 1, 2017, 8:19am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/11 "2017-04-01T08:19:40Z")

</div>

Again. please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

What OS are you on? What version?

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [April 1, 2017, 8:24am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/12 "2017-04-01T08:24:39Z")

</div>

I'm on Ubuntu 14.05.

The output of sudo service logstash configtest says "unrecognized service".

And the output of sudo service logstash start says "job is already running".

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 1, 2017, 8:31am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/13 "2017-04-01T08:31:23Z")

</div>

> [@safasalwan](#):
>
> sudo service logstash configtest

That's not a valid argument afaik.

What are you trying to do here?

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [April 1, 2017, 8:47am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/14 "2017-04-01T08:47:44Z")

</div>

I'm following [THIS](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) documentation by DO.

This is what it says:

"Test your Logstash configuration with this command:

[_sudo service logstash configtest_]

It should display **Configuration OK** if there are no syntax errors. Otherwise, try and read the error output to see what's wrong with your Logstash configuration."

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [April 2, 2017, 5:43am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/15 "2017-04-02T05:43:52Z")

</div>

I'm trying to execute this command:

"sudo update-rc.d logstash defaults 96 9"

this is the output:

"update-rc.d: /etc/init.d/logstash: file does not exist"

What's missing here?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [April 3, 2017, 4:04pm UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/16 "2017-04-03T16:04:25Z")

</div>

Why are you running an old tutorial (more than 2 years old, in fact) for an old version of Logstash, instead of getting the [documentation from the source](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html)?

You would have learned that [Logstash v5 automatically detects the correct init system (SysV, upstart, systemd) and installs the appropriate scripts.](https://www.elastic.co/guide/en/logstash/current/running-logstash.html)

If you don't like starting Logstash with upstart (`sudo initctl start logstash`) and still want it to use SysV style, you can force-create a SysV init script by running:

```auto
/usr/share/logstash/bin/system-install /etc/logstash/startup.options sysv 

```

The commands you attempted above may work after that.

---

<div class="post-metadata">

**Author:** ![safasalwan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/safasalwan/32/16563_2.png) [@safasalwan](https://discuss.elastic.co/u/safasalwan)\
**Post date:** [April 4, 2017, 8:14am UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/17 "2017-04-04T08:14:47Z")

</div>

## I tried following both documentations, none of them worked.

When I run [quote="theuntergeek, post:16, topic:80614"]  
sudo initctl start logstash  
[/quote] it says command not found.

And when I run [quote="theuntergeek, post:16, topic:80614"]  
/usr/share/logstash/bin/system-install /etc/logstash/startup.options sysv  
[/quote] it says unable to install system startup script for Logstash.

What's the problem here?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [April 4, 2017, 3:23pm UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/18 "2017-04-04T15:23:09Z")

</div>

If `initctl` is not present on Ubuntu 14.04, you must have a setup that differs from default Ubuntu 14.04. The `initctl` command is present on Ubuntu 14.04 by default:

```auto
root@ubuntu1404-pkg-test:~$ initctl
initctl: missing command
Try `initctl --help' for more information.

```

It would be helpful if you would cut and paste the errors here between rows of triple back-ticks, like this:

````
```
PASTED CODE
```

````

Without output, it will be difficult—if not impossible—to resolve your issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2017, 3:23pm UTC](https://discuss.elastic.co/t/help-logstash-isnt-working/80614/19 "2017-05-02T15:23:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
