# How to run logstash service in the background? **URL:** \ **Category:** Logstash\ **Created:** [August 4, 2020, 3:47am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645 "2020-08-04T03:47:19Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 4, 2020, 3:47am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/1 "2020-08-04T03:47:19Z")
I installed and configured ELK in a CentOS environment. I have been using the following command to run logstash in the foreground and it works perfectly. > ./usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf Now I want to implement it into the production environment and hence I would like to run the logstash service in the background by which I did tried to run it with > systemctl start logstash As usual, I always check with the indices with > [http://localhost:9200/\_cat/indices](http://localhost:9200/_cat/indices) But logstash doesn't seem to work if I am not running it in the foreground and there's also no log generated as well if I run with _systemctl start logstash_. Another thing is that I have also made some changes to the default logstash.yml file to increase the batch.size, batch.delay and etc but logstash doesn't capture the changes when I run _./usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf_. I have been trying to solve this for the past few days and I need help on this. Thank you so much. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 4, 2020, 3:49am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/2 "2020-08-04T03:49:43Z")
> [@evacch](#): > > But logstash doesn't seem to work if I am not running it in the foreground and there's also no log generated as well if I run with _systemctl start logstash_ . There's nothing in `/var/log/logstash`? ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 4, 2020, 3:53am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/3 "2020-08-04T03:53:31Z")
All the logstash logs are stored under `/usr/share/logstash/logs` and yes there's log found in there when I run using > /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf but there's nothing when I run using > systemctl start logstash ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 4, 2020, 3:55am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/4 "2020-08-04T03:55:26Z")
If you installed the RPM then [the default location](https://www.elastic.co/guide/en/logstash/current/dir-layout.html#deb-layout) is `/var/log/logstash`. If you didn't use the RPM, how did you install it? ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 4, 2020, 4:27am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/5 "2020-08-04T04:27:03Z")
I run with > sudo yum install logstash and yes there's such folder `/var/log/logstash`as configured in the logstash.yml ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3e6606258f17241a6581e25939b3a9f76e0d730.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 4, 2020, 4:28am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/7 "2020-08-04T04:28:25Z")
Did you add our [source repos](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html#package-repositories)? What version did it install? ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 4, 2020, 6:49am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/8 "2020-08-04T06:49:22Z")
Yes I did. the current version is 7.8.0. ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 4, 2020, 7:02am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/10 "2020-08-04T07:02:39Z")
It works fine now with > ./usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -b 3000 -u 30 & I am not sure if this is a good practice to start logstash service. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [August 4, 2020, 7:14am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/11 "2020-08-04T07:14:41Z")
If it works when you start it like that, but not as a service, it might be a permissions issue, e.g. your log directory being writable by root, but not by the Logstash user. ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 5, 2020, 3:47am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/12 "2020-08-05T03:47:07Z")
I have changed all logstash related files and folders permission to logstash user via > chown logstash:logstash _folder/file_ after that, I run > systemctl stop logstash then > systemctl start logstash but it's still the same. ---
**Author:** ![evacch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evacch/32/49448_2.png) [@evacch](https://discuss.elastic.co/u/evacch)\ **Post date:** [August 7, 2020, 6:59am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/13 "2020-08-07T06:59:41Z")
Hello, is there any solution for this? I am stuck for couple days. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [August 7, 2020, 7:58am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/14 "2020-08-07T07:58:16Z")
I would use `chown -R` on the relevant folders to make sure that really no file is forgotten, try it again and check the logstash log directory and syslog. But if it really doesn't say anything anywhere, it's difficult to debug. Maybe you could run `sudo -u logstash /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf`. If that works, it's probably something about the config, not the user, that keeps it from working? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2020, 7:58am UTC](https://discuss.elastic.co/t/how-to-run-logstash-service-in-the-background/243645/15 "2020-09-04T07:58:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.