Logstash CLI not working

[capsno1 (James)]

I managed to install logstash recently but I am unable to use any cli commands.

I followed these instructions (https://www.elastic.co/guide/en/logstash/current/installing-logstash.html) using APT.

I had to start logstash using "sudo initctl start logstash"

When I type commands this is what I get:

server:/# bin/logstash -e 'input { stdin { } } output { stdout {} }'
-bash: bin/logstash: No such file or directory

server:/# logstash -e 'input { stdin { } } output { stdout {} }'
logstash: command not found

server:/# cd /opt/logstash/bin
-bash: cd: /opt/logstash/bin: No such file or directory

any help would be appreciated

[magnusbaeck (Magnus Bäck)]

The directory structure of Logstash's Debian packages has changed recently. You can use dpkg-query -L logstash to list the files installed by the package.

[capsno1 (James)]

Thanks…..

Now I need to get around this error…

root@fgprd-oncommand-elasticlog-app001:/var/log/logstash# cat logstash.log
{:timestamp=>"2017-02-03T12:58:35.212000-0500", :message=>"An unexpected error occurred!", :error=>#<Errno::EACCES: Permission denied - bind(2)>, :class=>"Errno::EACCES", :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in initialize'", "org/jruby/RubyIO.java:853:innew'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:244:in new_server_socket'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:79:inregister'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:322:in start_inputs'", "org/jruby/RubyArray.java:1613:ineach'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:321:in start_inputs'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:172:instart_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:126:in run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/agent.rb:210:inexecute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/runner.rb:90:in run'", "org/jruby/RubyProc.java:281:incall'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/runner.rb:95:in run'", "org/jruby/RubyProc.java:281:incall'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:in `initialize'"], :level=>:warn}

I can’t seem to get the service to open the 514 ports

[magnusbaeck (Magnus Bäck)]

No, that's because only root can bind to ports <1024. That matter has been discussed here (and elsewhere) many times before.

[capsno1 (James)]

I'm not sure if this is a fix or a workaround but I had to set the net_bind_service capabilities to the java binary.
setcap cap_net_bind_service=+epi /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java
This fixed my issue and logstash is running fine and the ports I named in the config file are now listening.