# How to run logstash as a service in CentOS

**URL:** <https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461>\
**Category:** Logstash\
**Created:** [July 18, 2018, 6:58am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461 "2018-07-18T06:58:02Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 18, 2018, 6:58am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/1 "2018-07-18T06:58:02Z")

</div>

I am able to run logstash successfully using below:

`/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/app.conf`

But it is not working, when i run following commands

`/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/app.conf &`  
`nohup /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/app.conf &`

Thanks in advance

---

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 18, 2018, 9:00am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/2 "2018-07-18T09:00:04Z")

</div>

Hi @ramanna_hk,  
wich version of Centos are you using?

---

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 18, 2018, 9:07am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/3 "2018-07-18T09:07:02Z")

</div>

version 7.5

---

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 18, 2018, 9:13am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/4 "2018-07-18T09:13:14Z")

</div>

Did you try with the systemctl commands?

# start

systemctl start logstash

# stop

systemctl stop logstash

# enable on boot

systemctl enable logstash

---

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 18, 2018, 9:35am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/5 "2018-07-18T09:35:57Z")

</div>

Yes @pge

and pipline.yml file includes:

- pipeline.id: main  
path.config: "/usr/share/app.conf"

logstash is running but data is not indexing.

---

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 18, 2018, 10:16am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/6 "2018-07-18T10:16:30Z")

</div>

I think that this is a different issue.....

1. if logstash is correctly configured systemctl should be enough to run logstash. If you don´t have a index you have to check your configuration file on /etc/logstash/conf.d

2. why you have to run a command line like that?

---

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 18, 2018, 10:21am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/7 "2018-07-18T10:21:07Z")

</div>

Thank you @pge

1. No problem in configuration file.
2. I want to run logstash as a service(in background) in production machine.

---

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 18, 2018, 10:40am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/8 "2018-07-18T10:40:04Z")

</div>

@ramanna_hk on centos 7 systemctl is the default command to run services.

Remember also that running logstash as a service include many setting (for example /etc/systemd/system/logstash.service or /etc/default/logstash ) then I use the command line like "/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/app.conf" just for testing, otherwise systemctl.

If logstash doen´t work correctly with systemctl I think that you got a different problem

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [July 18, 2018, 12:33pm UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/9 "2018-07-18T12:33:10Z")

</div>

You need to first configure `startup.options` and then run `logstash/bin/system-install` first, in order to add the files for systemd.

[https://www.elastic.co/guide/en/logstash/current/config-setting-files.html](https://www.elastic.co/guide/en/logstash/current/config-setting-files.html)

---

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 19, 2018, 6:06am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/10 "2018-07-19T06:06:05Z")

</div>

default configurations in `startup.option` and also when i run logstash using `systemctl start logstash`

logs of logstash are:  
[2018-07-19T11:26:14,579][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"localhost:5044"}  
[2018-07-19T11:26:14,876][INFO][org.logstash.beats.Server] Starting server on port: 5044  
[2018-07-19T11:26:14,983][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x544f63a5 sleep\>"}  
[2018-07-19T11:26:15,434][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>[]}  
[2018-07-19T11:26:16,291][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

But `data is not indexing`

Please tell me what should i change in configuration

Thank you

---

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 19, 2018, 6:15am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/11 "2018-07-19T06:15:07Z")

</div>

Hi @ramanna_hk,  
may you post your /etc/logstash/conf.d/\* configuration?

---

<div class="post-metadata">

**Author:** ![ramanna\_hk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramanna_hk/32/52522_2.png) [@ramanna\_hk](https://discuss.elastic.co/u/ramanna_hk)\
**Post date:** [July 19, 2018, 6:23am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/12 "2018-07-19T06:23:52Z")

</div>

Note: same `conf` is working by this command `/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/app.conf`

beats {  
port =\> 5044  
host =\> "localhost"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> [  
"Machine\_id",  
"Time",  
"CRCErrors\_Current\_Value",  
"CRCErrors\_Severity",  
"CRCErrors\_Min\_Current\_Value",  
"CRCErrors\_Max\_Current\_Value",  
"DownlinkJitter\_Current\_Value",  
"DownlinkJitter\_Severity",  
"DownlinkJitter\_Warning.Threshold",  
"DownlinkJitter\_Critical.Threshold",  
"DownlinkJitter\_Min\_Current\_Value",  
"DownlinkJitter\_Max\_Current\_Value",  
"DownlinkRSSI\_Current\_Value",  
"DownlinkRSSI\_Severity",  
"DownlinkRSSI\_Warning.Threshold",  
"DownlinkRSSICritical.Threshold",  
"DownlinkRSSI\_Min\_Current\_Value",  
"DownlinkRSSI\_Max\_Current\_Value",  
"DownlinkUtilization\_Current\_Value",  
"DownlinkUtilization\_Severity",  
"DownlinkUtilization\_Min\_Current\_Value",  
"DownlinkUtilization\_Max\_Current\_Value",  
"Frequency\_Current\_Value",  
"Frequency\_Severity",  
"Frequency\_Min\_Current\_Value",  
"Frequency\_Max\_Current\_Value",  
"Latency\_Current\_Value",  
"Latency\_Severity",  
"Latency\_Warning.Threshold",  
"Latency\_Critical.Threshold",  
"Latency\_Min\_Current\_Value",  
"Latency\_Max\_Current\_Value",  
"PacketDrop\_Current\_Value",  
"PacketDrop\_Severity",  
"PacketDrop\_Warning.Threshold",  
"PacketDrop\_Critical.Threshold",  
"PacketDrop\_Min\_Current\_Value",  
"PacketDrop\_Max\_Current\_Value",  
]  
}  
date {  
match =\> ["Time", "YYYY/MM/dd-HH:mm:ss", "YYYY/MM/dd-HH:mm:ss.S-SS "]  
target =\> "Time"  
}  
mutate {convert =\> ["CRCErrors\_Current\_Value","float"]}  
mutate {convert =\> ["CRCErrors\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["CRCErrors\_Max\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkJitter\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkJitter\_Warning.Threshold","float"]}  
mutate {convert =\> ["DownlinkJitter\_Critical.Threshold","float"]}  
mutate {convert =\> ["DownlinkJitter\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkJitter\_Max\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkRSSI\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkRSSI\_Warning.Threshold","float"]}  
mutate {convert =\> ["DownlinkRSSI\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkRSSI\_Max\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkUtilization\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkUtilization\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["DownlinkUtilization\_Max\_Current\_Value","float"]}  
mutate {convert =\> ["Frequency\_Current\_Value","float"]}  
mutate {convert =\> ["Frequency\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["Frequency\_Max\_Current\_Value","float"]}  
mutate {convert =\> ["Latency\_Current\_Value","float"]}  
mutate {convert =\> ["Latency\_Warning.Threshold","float"]}  
mutate {convert =\> ["Latency\_Critical.Threshold","float"]}  
mutate {convert =\> ["Latency\_Min\_Current\_Value","float"]}  
mutate {convert =\> ["Latency\_Max\_Current\_Value","float"]}

}  
output {  
if [type] == "cpe9101"{  
stdout { codec =\> rubydebug }  
elasticsearch {  
action =\> "index"  
hosts =\> ["localhost:9200"]  
index =\> "cpe9101-%{+YYYY.MM.dd}"  
document\_type =\> "cpe9101"

```
  }
}
if [type] == "cpe9102"{
   stdout { codec => rubydebug }
   elasticsearch {
       action => "index"
       hosts => ["localhost:9200"]
       index => "cpe9102-%{+YYYY.MM.dd}"
       document_type => "cpe9101"

  }
}
if [type] == "cpe9103"{
   stdout { codec => rubydebug }
   elasticsearch {
       action => "index"
       hosts => ["localhost:9200"]
       index => "cpe9103-%{+YYYY.MM.dd}"
       document_type => "cpe9101"
  }
}

```

}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2018, 6:23am UTC](https://discuss.elastic.co/t/how-to-run-logstash-as-a-service-in-centos/140461/13 "2018-08-16T06:23:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.