How can i start the netflow module through the systemctl

Hi all, now i can start my netflow module in my logstash through the command line.But i'd like to start it by systemctl.But i failed.

/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M netflow.var.elasticsearch.hosts="," -M"" "--path.settings" "/etc/logstash"

When i using the command above , it does work.And the configuration of logstash.service is just like:


ExecStart=/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M netflow.var.elasticsearch.hosts="," -M"" "--path.settings" "/etc/logstash"


But when i start the service , i can see the error in the log.

[2017-12-26T09:35:32,200][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::ConfigLoadingError: Failed to parse the module configuration: [Illegal character in authority at index 7: http://""/api/status]>, :backtrace=>["$", "$Parser.parseAuthority(java/net/", "$Parser.parseHierarchical(java/net/", "$Parser.parse(java/net/", "", "org.apache.http.client.utils.URIBuilder.(org/apache/http/client/utils/", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/", "RUBY.uri_from_url_and_options(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:450)", "RUBY.request_from_options(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:457)", "RUBY.request(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:418)", "RUBY.get(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:246)", "RUBY.http(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:300)", "RUBY.safely(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:112)", "RUBY.get(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:89)", "RUBY.initialize(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:64)", "RUBY.pipeline_configs(/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:73)", "org.jruby.RubyArray.each(org/jruby/", "RUBY.pipeline_configs(/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:56)", "RUBY.execute(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:276)", "", "", "", "usr.share.logstash.lib.bootstrap.environment.(root)(/usr/share/logstash/lib/bootstrap/environment.rb:71)", "usr.share.logstash.lib.bootstrap.environment.(root)(usr/share/logstash/lib/bootstrap//usr/share/logstash/lib/bootstrap/environment.rb:71)"]}

How did you install Logstash?

Through the RPM.
I just want to add some parameters to start the netflow module, but it does not work

I have found the solution,I think it's the problem of format.When i changing the service file as following , it does work!

ExecStart=/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M "," -M "" "--path.settings" "/etc/logstash"

Have you found the difference ? The location of the double quotation marks is important .
But until now i do not know the reason,is there anyone can help me to answer it ?

Why not just use the included service file?

I am indeed using the included service file,but i need to add some parameters to start the netflow module....

You shouldn't need to edit the service file directly, have a look at

Maybe you misunderstood my meaning, i am indeed using the service file directly.But if you do not add any parameter in that file , you can not use netflow module in the logstash.That is why i add some parameters in the service file...

There are configuration files that this needs to live in, not the service file.

Look at /etc/logstash/startup.options, specifically the LS_OPTS section.

i will try that first , thank you

Wow , it does work, no i do not need to add any parameters in the service file, i only need to add "--setup" in the startup.yml , then i can start the netflow module
Thank you so much Warkolm:grinning:

No worries, glad we got it sorted in the end :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.