It seems that logstash cant find logstash.yml , but it is located in the default directory.
:/usr/share/logstash$ sudo bin/logstash --log.level=debug -t -f /etc/logstash/conf.d/logstash.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[DEBUG] 2017-12-20 14:24:48.792 [LogStash::Runner] DateFilter - Date filter with format=MMM dd HH:mm:ss, locale=null, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.807 [LogStash::Runner] DateFilter - Date filter with format=MMM dd HH:mm:ss, locale=en-US, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.808 [LogStash::Runner] DateFilter - Date filter with format=MMM d HH:mm:ss, locale=null, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.808 [LogStash::Runner] DateFilter - Date filter with format=MMM d HH:mm:ss, locale=en-US, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.808 [LogStash::Runner] DateFilter - Date filter with format=MMM dd yyyy HH:mm:ss, locale=null, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.809 [LogStash::Runner] DateFilter - Date filter with format=MMM dd yyyy HH:mm:ss, locale=en-US, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.809 [LogStash::Runner] DateFilter - Date filter with format=MMM d yyyy HH:mm:ss, locale=null, timezone=null built as org.logstash.filters.parser.JodaParser
[DEBUG] 2017-12-20 14:24:48.809 [LogStash::Runner] DateFilter - Date filter with format=MMM d yyyy HH:mm:ss, locale=en-US, timezone=null built as org.logstash.filters.parser.JodaParser
Configuration OK
:/usr/share/logstash$ ls /etc/logstash/
conf.d log4j2.properties logstash.yml startup.options
1:/usr/share/logstash$
also I can't use the configtest
:/usr/share/logstash$ sudo service logstash configtest
logstash: unrecognized service
:/usr/share/logstash$ sudo service logstash status
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: enabled)
Active: failed (Result: exit-code) since ons 2017-12-20 14:16:34 CET; 16min ago
Process: 1444 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=143)
Main PID: 1444 (code=exited, status=143)
dec 20 14:16:25 systemd[1]: Started logstash.
dec 20 14:16:33 systemd[1]: Stopping logstash...
dec 20 14:16:34 systemd[1]: logstash.service: Main process exited, code=exited, status=143/n/a
dec 20 14:16:34 systemd[1]: Stopped logstash.
dec 20 14:16:34 systemd[1]: logstash.service: Unit entered failed state.
dec 20 14:16:34 systemd[1]: logstash.service: Failed with result 'exit-code'.
I temporary stopped logstash and trying to run it manually with debugging.