Logstash 6.3 Installation Failure

Elastic Stack Logstash
1

Hi All,

  • I needed to install logstash -6.3 in my centos 7 VM.

  • I have downloaded the setup (logstash-6.3.0.rpm) from https://www.elastic.co/downloads/past-releases/logstash-6-3-0 location.

  • I have used the following command to install the package
    sudo rpm -i logstash-6.3.0.rpm

  • I have added my config file to the "/etc/logstash/conf.d" location

  • When starting for the first time it is not starting properly. No log file is created in the "/var/log/logstash" location and the service status shows as follow.

[igwstuser@analytics pack]$ sudo systemctl status logstash
? logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2019-01-18 15:02:40 +08; 1s ago
Process: 13861 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE)
Main PID: 13861 (code=exited, status=1/FAILURE)

Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: Unit logstash.service entered failed state.
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: logstash.service failed.
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: logstash.service holdoff time over, scheduling restart.
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: start request repeated too quickly for logstash.service
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: Failed to start logstash.
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: Unit logstash.service entered failed state.
Jan 18 15:02:40 analytics.apistg.celcom.com.my systemd[1]: logstash.service failed.

Please help me to find out the cause for this.
Am I missing any step?

Thanks

2

@Manoj_Hettiarachchi

Probably, you need to change the ownership of /var/log/logstash folder to logstash user.

1 Like
3

@Makra

When I start the logstsha using the command
sudo systemctl start logstash
it is not working
But when I use the
sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash

Logstash is starting up properly and logs are there in the var/log/logstash location.

Do yu have any idea why systemctl fails to start the service

4

Check the debug log. The systemctl service is not starting may be because of permissions issues. You probably need to check the ownership of logstash data directory.

You are able to run it from command line because it is executed by root user while in the service file the owner and group to run logstash as service is not root.

1 Like
5

Hi @Makra

Thanks for all the advises,
I was able to solve the issue. The issue was deu to a java location in my virtual machine.
When I start manually it detects my $JAVA_HOME bin location and starts correctly.
When started as a service it searches for /usr/bin/java that makes the problem.
I have added a symlink of my java location to /usr/bin/java location.
Now logtstash is working.

Thanks.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.