# LogStash 2.2 start as a service does not read config file **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2016, 3:53pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675 "2016-03-07T15:53:36Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Jeremy\_Colton](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Post date:** [March 7, 2016, 3:53pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/1 "2016-03-07T15:53:37Z")
Hi, I am running logstash 2.2 on ubuntu 14.0.4. I SSH into my linux box using a cert and sudo to root user. My config file is under /etc/logstash/conf.d/default.conf. a) When I run logstash from the command line: #/opt/logstash/bin/logstash -f /etc/logstash/conf.d/default.conf I see after ~10 seconds: Settings: Default pipeline workers: 1 Logstash startup completed When I send logs to my nginx which LogStash is reading I see an increase in my ElasticSearch entry count via: #curl 'localhost:9200/\_count?pretty=1' b) When I run logstash as a service: #service logstash start It instantly prints: logstash started service logstash status says the service is running. But it doesn't seem to read my default.conf file since I see no increase in hits when I run: #curl 'localhost:9200/\_count?pretty=1' I have tried to fix this via: 1. changing file owner and group permissions on my default.conf file 2. adding a logstash.conf file 3. reading the /etc/init.d/logstash file - no joy 4. I see no errors in the /var/log/logstash/logstash.err or logstash.log files So, how do I run logstash as a service and have it read my default.conf file? Many thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2016, 6:14pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/2 "2016-03-07T18:14:42Z")
Try upping the log level by starting Logstash with `--verbose` (or even `--debug`, but then it starts to get hard to identify the really interesting parts). You pass those options by modifying LS\_OPTS in /etc/default/logstash. It could be a permission problem with the log files, which Logstash will tell you about in its verbose logs. ---
**Author:** ![michalterbert](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@michalterbert](https://discuss.elastic.co/u/michalterbert)\ **Post date:** [March 7, 2016, 7:15pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/3 "2016-03-07T19:15:14Z")
can you share with us our config file for logstash? are you sure about permission for logstash (not only config) but all applicaion folder (ex. /opt/logstash)? run logstash wit DEBUG=1 or verbose. ---
**Author:** ![Jeremy\_Colton](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Post date:** [April 6, 2016, 2:29pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/4 "2016-04-06T14:29:21Z")
Sorry for the delay, it started to work! Now I updated my logstash config file and it stopped working again! I changed the log level to debug as you suggested and now my log file spits out a lot of info that I have no idea what it's doing! My config file is under /etc/logstash/conf.d/default.conf service logstash configtest - says config is ok Where does Logstash look for the config file? I run logstash as a service as follows: sudo service logstash start This results in seeing: sudo service logstash restart Killing logstash (pid 25831) with SIGTERM Waiting logstash (pid 25831) to die... Waiting logstash (pid 25831) to die... logstash stopped. logstash started. But, the logstash.log says: {:timestamp=\>"2016-04-07T15:19:25.511000+0000", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} So it looks like, this pipeline is what ingests the nginx logs and it's not open??? service logstash status - says "logstash is running" The contents of these folders are all owned by the 'logstash' user and group: /var/log/logstash /opt/logstash /etc/logstash On startup, my logstash.log file says: {:timestamp=\>"2016-04-07T15:08:21.282000+0000", :message=\>"Registering file input", :path=\>["/var/log/nginx/web\_pixels.log"], :level=\>:info} {:timestamp=\>"2016-04-07T15:08:21.299000+0000", :message=\>"No sincedb\_path set, generating one based on the file path", :sincedb\_path=\>"/var/lib/logstash/.$ {:timestamp=\>"2016-04-07T15:08:21.825000+0000", :message=\>"Using mapping template from", :path=\>nil, :level=\>:info} {:timestamp=\>"2016-04-07T15:08:22.365000+0000", :message=\>"Attempting to install template", :manage\_template=\>{"template"=\>"logstash-\*", "settings"=\>{"inde$ {:timestamp=\>"2016-04-07T15:08:22.750000+0000", :message=\>"New Elasticsearch output", :class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["127.0.0.1:9200"$ {:timestamp=\>"2016-04-07T15:08:23.626000+0000", :message=\>"Using geoip database", :path=\>"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-$ {:timestamp=\>"2016-04-07T15:08:24.469000+0000", :message=\>"Starting pipeline", :id=\>"base", :pipeline\_workers=\>1, :batch\_size=\>125, :batch\_delay=\>5, :max\_i$ {:timestamp=\>"2016-04-07T15:08:24.519000+0000", :message=\>"Pipeline started", :level=\>:info} Please help! Here's my config file: ``` input { #stdin {} file { path => "/var/log/nginx/web_pixels.log" type => "web" } } output { #stdout { codec => rubydebug } elasticsearch { hosts => ["127.0.0.1:9200"] document_id => "%{[@metadata][doc_id]}" #document_type => "%{pr}" } } filter { kv{} kv { field_split => "&?" exclude_keys => ["rv"] source => "args" } date { match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"] } fingerprint { source => ["message", "type"] key => "my-key" concatenate_sources => true target => "[@metadata][doc_id]" } geoip { source => "clientip" #fields => ["city_name", "country_name", "timezone", "country_code2"] add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { remove_field => ["message", "args", "countrycode", "city"] convert => ["[geoip][coordinates]", "float"] } useragent { source => "agent" prefix => "ua_" } } ``` ---
**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Post date:** [April 7, 2016, 3:38pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/5 "2016-04-07T15:38:00Z")
The log makes it seem like it's working. What exactly is not working? > Where does Logstash look for the config file? The Logstash sysconfig is at `/etc/sysconfig/logstash` so check what is set for `LS_CONF_DIR`. If that file is missing then the default is also kept in the start script at `/etc/init.d/logstash`. In both cases they are set to `/etc/logstash/conf.d` by default though so it should be finding it fine if you haven't changed anything. ---
**Author:** ![Jeremy\_Colton](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Post date:** [April 8, 2016, 4:33pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/6 "2016-04-08T16:33:32Z")
...after more investigating Logstash didn't have permission to read my nginx file! I changed the permission of my nginx log folder to worldwide (chmod 777). It would be nice to see the following entries in the logstash log to show what state it's in: a) 'permission denied' message in the logstash log (verbose level) b) pipline open/started (non verbose level, since it shows the pipe is shut at this low level) Thanks. ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 5, 2017, 3:01pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/7 "2017-02-05T15:01:03Z")
Alex, I tried to locate both of those files but was not able to : /etc/sysconfig/logstash and /etc/init.d/logstash. Any suggestions as to where to find them? Thanks, ---
**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Post date:** [February 7, 2017, 9:56pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/8 "2017-02-07T21:56:11Z")
Hi Rinat. You should try to avoid resurrecting old threads! Those files are installed in the RPM version. Is that the version you used? ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 7, 2017, 10:06pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/9 "2017-02-07T22:06:41Z")
Thanks for the correction. I just tried to avoid to create duplicate topics while similar issues were addressed before. I'll avoid resurrecting old ones from now. I used this : rpm --import [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) Add the following in your /etc/yum.repos.d/ directory in a file with a .repo suffix, for example logstash.repo [logstash-5.x] name=Elastic repository for 5.x packages baseurl=https://artifacts.elastic.co/packages/5.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md sudo yum install logstash sudo systemctl start logstash.service ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 7, 2017, 10:56pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/10 "2017-02-07T22:56:49Z")
Is this what you are referring to?! ---
**Author:** ![daddyyankee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daddyyankee/32/19259_2.png) [@daddyyankee](https://discuss.elastic.co/u/daddyyankee)\ **Post date:** [June 19, 2017, 2:35pm UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/11 "2017-06-19T14:35:26Z")
I have the same problem - checked configs and ran the following all to no avail. sudo systemctl enable logstash.service ^ start logstash.service When I tail -f /var/log/logstash/logstash-plain.log I do not see the system as starting up at all. Only when I run the manual /bin/logsash with a config file does the service start. Could my problem be that I once applied, but no longer have the free trial of X-Pack authentication? dropped it like it was hot. And now have no authentication on the Logstash config where there once was a certificate and login? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 4:15am UTC](https://discuss.elastic.co/t/logstash-2-2-start-as-a-service-does-not-read-config-file/43675/12 "2022-11-04T04:15:57Z")