How can i start the netflow module through the systemctl

Elastic Stack Logstash
1

Hi all, now i can start my netflow module in my logstash through the command line.But i'd like to start it by systemctl.But i failed.

/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M netflow.var.elasticsearch.hosts="ph71v-esn01.ae007.com:9200,ph71v-esn02.ae007.com:9200" -M netflow.var.kibana.host="logs.ae007.com:5601" "--path.settings" "/etc/logstash"

When i using the command above , it does work.And the configuration of logstash.service is just like：

[Unit]
Description=logstash

[Service]
Type=simple
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M netflow.var.elasticsearch.hosts="ph71v-esn01.ae007.com:9200,ph71v-esn02.ae007.com:9200" -M netflow.var.kibana.host="logs.ae007.com:5601" "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target

But when i start the service , i can see the error in the log.

[2017-12-26T09:35:32,200][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::ConfigLoadingError: Failed to parse the module configuration: [Illegal character in authority at index 7: http://"logs.ae007.com:5601"/api/status]>, :backtrace=>["java.net.URI$Parser.fail(java/net/URI.java:2848)", "java.net.URI$Parser.parseAuthority(java/net/URI.java:3186)", "java.net.URI$Parser.parseHierarchical(java/net/URI.java:3097)", "java.net.URI$Parser.parse(java/net/URI.java:3053)", "java.net.URI.(java/net/URI.java:588)", "org.apache.http.client.utils.URIBuilder.(org/apache/http/client/utils/URIBuilder.java:82)", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:423)", "RUBY.uri_from_url_and_options(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:450)", "RUBY.request_from_options(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:457)", "RUBY.request(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:418)", "RUBY.get(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:246)", "RUBY.http(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.6.1-java/lib/manticore/client.rb:300)", "RUBY.safely(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:112)", "RUBY.get(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:89)", "RUBY.initialize(/usr/share/logstash/logstash-core/lib/logstash/modules/kibana_client.rb:64)", "RUBY.pipeline_configs(/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:73)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)", "RUBY.pipeline_configs(/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:56)", "RUBY.execute(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:276)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67)", "RUBY.run(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132)", "usr.share.logstash.lib.bootstrap.environment.(root)(/usr/share/logstash/lib/bootstrap/environment.rb:71)", "usr.share.logstash.lib.bootstrap.environment.(root)(usr/share/logstash/lib/bootstrap//usr/share/logstash/lib/bootstrap/environment.rb:71)"]}

2

How did you install Logstash?

3

Through the RPM.
I just want to add some parameters to start the netflow module, but it does not work

4

I have found the solution,I think it's the problem of format.When i changing the service file as following , it does work!

ExecStart=/usr/share/logstash/bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 -M "netflow.var.elasticsearch.hosts:9200=ph71v-esn01.ae007.com,ph71v-esn02.ae007.com:9200" -M "netflow.var.kibana.host:5601=logs.ae007.com" "--path.settings" "/etc/logstash"

Have you found the difference ? The location of the double quotation marks is important .
But until now i do not know the reason,is there anyone can help me to answer it ?

5

Why not just use the included service file?

6

I am indeed using the included service file,but i need to add some parameters to start the netflow module....

7

You shouldn't need to edit the service file directly, have a look at https://www.elastic.co/guide/en/logstash/current/running-logstash.html

8

Maybe you misunderstood my meaning, i am indeed using the service file directly.But if you do not add any parameter in that file , you can not use netflow module in the logstash.That is why i add some parameters in the service file...

9

There are configuration files that this needs to live in, not the service file.

Look at /etc/logstash/startup.options, specifically the LS_OPTS section.

10

i will try that first , thank you

11

Wow , it does work, no i do not need to add any parameters in the service file, i only need to add "--setup" in the startup.yml , then i can start the netflow module
Thank you so much Warkolm:grinning:

12

No worries, glad we got it sorted in the end :slight_smile:

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.