Logstash command not found error

I have ubuntu 16.04 system, I ahve logstash installed in /etc/logstash the command

sudo service logstash start

works well but the command

/bin/logstash -f logstash.conf does work

I have one more location /usr/share/logstash/bin but I am not able to run above command,please guide asap

Hi @alpha_gamma,

you try this path to run your configuration file: /usr/share/logstash/bin
(save config file in this path and run following command)

in that bin you type following command:
.\logstash -f .\logstash.conf

i think its work.

Thanks & Regards,

1 Like

Hi Krunal thanks for reply still it says command not found

If I do sudo service logstash start it works but that I dont seem relevant to parse config file

can you show me your config file and which ELK stack version are you currently running?

like I am putting config file in /etc/logstash/conf.d


input {
file {
path => "/var/log/*"
start_position => "beginning"

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "syslog-%{+YYYY.MM.dd}"
stdout { codec => rubydebug }

I think I am using lostash 6.1 version

if at a time you have to run one conf file then you save your conf file in /usr/share/logstash/bin and then type command sudo .\logstash -f .\logstash.conf
otherwise sudo logstash -f logstash.conf you try both coz in my i have working fine

here is the command that how to start the service and run the file:


if any issue ask me

Thanks & Regards,

ya I had run already thanks
I found in other thread

thanks from hear again I found command here

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/file.conf --config.test_and_exit

1 Like

@alpha_gamma great..:blush::grinning:

you are welcome ,krunal I am strange why these things are not in standard books,with new technologies requires a lot of hit and trial ,some times things very easy and some times take too much time .hahahah:grinning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.