Logstash 5.4.0 not writing logs or opening port

[Geezer]

Hello,

I have a new install of Logstash 5.4.0 on CentOS 7 with a single beat input and output configured.

The service starts, and sytemctl says it is running, but it won't open the TCP port, connect to RabbitMQ or write any logs. The configs files are held in /etc/logstash/conf.d:

input {
beats {
port => 5044
tags => ["winlogbeat"]
}
}

output {
if "winlogbeat" in [tags] {
rabbitmq {
key => "winlogbeatkey"
exchange => "winlogbeatex"
exchange_type => "direct"
user => "logstashuser"
password => "xxxxxx"
host => "127.0.0.1"
port => 5672
durable => true
persistent => true
}
}
}

I have tried starting it with debug flags but get nothing.

Can anyone suggest what's wrong?

Thank you

[magnusbaeck (Magnus Bäck)]

Does https://github.com/elastic/logstash/issues/6117 help?

[Geezer]

Thank you for the suggestion, I will look into that.

[Geezer]

Managed to start it in debug mode but had to specify the path to the yml. Without doing so, I get this error:

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console

The logstash.yml is in /etc/logstash, but until I specified that fact with --path.settings logstash couldn't find it. Once I did, logstash loaded.

It can;t find the log4j2 file either.

Why would it not be able to find these files in the default path?

Thanks

[Geezer]

Further:

The service file is here: /etc/systemd/system/logstash.service

It contains the following which is all default:

[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target

It points to an EnvironmentFile here: /etc/default/logstash

...which contains the following:

JAVACMD="/usr/bin/java"
LS_HOME="/usr/share/logstash"
LS_SETTINGS_DIR="/etc/logstash"
LS_PIDFILE="/var/run/logstash.pid"
LS_USER="logstash"
LS_GROUP="logstash"
LS_GC_LOG_FILE="/var/log/logstash/gc.log"
LS_OPEN_FILES="16384"
LS_NICE="19"
SERVICE_NAME="logstash"
SERVICE_DESCRIPTION="logstash"

So it has all the correct paths, all default, but when I start Logstash as a service it doesn't find the settings file, and hence no logging and no config file.

Starting it like this from /usr/share/logstash works:

bin/logstash --debug --path.settings /etc/logstash/

When I start it manually and specify the settings file I am doing so as root rather than the logstash user, but the /etc/logstash directory is readable by everyone

drwxrwxr-x 2 root root 71 May 12 09:42 conf.d
-rw-r--r-- 1 root root 1738 Apr 28 14:15 jvm.options
-rw-r--r-- 1 root root 1334 Apr 28 14:15 log4j2.properties
-rw-r--r-- 1 root root 223 May 11 22:40 logrotate.logstash.conf
-rw-r--r-- 1 root root 4483 May 12 13:49 logstash.yml
-rw-r--r-- 1 root root 1659 Apr 28 14:15 startup.options