# Logstash doesn't read config from /etc/logstash/conf.d/

**URL:** https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161
**Category:** Logstash
**Created:** [September 9, 2016, 11:01am UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161 "2016-09-09T11:01:41Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sgm](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@sgm](https://discuss.elastic.co/u/sgm)
#### Post date: [September 9, 2016, 11:01am UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161/1 "2016-09-09T11:01:41Z")

</div>

Hello. Sorry for my english.

I installed logstash-2.4.0\_all.deb on ubuntu server 16.04.1.  
I wrote in /etc/logstash/conf.d/ex.conf:  
input {  
tcp {  
type =\> "eventlog"  
port =\> 3515  
codec =\> json  
}  
} filter {  
}

output {  
elasticsearch {  
cluster =\> "elasticsearch"  
node\_name =\> "Franz Kafka"  
}  
}

And I started logstash by the "sudo service logstash start".  
By the "sudo service logstash status" I saw that logstash active.  
But no file logstash.log in /var/log/logstash.  
And no open tcp port 3515 by the "sudo netstat -lpn"

For test I deleted word "input" in /etc/logstash/conf.d/ex.conf and restart logstash.  
No entryes about this event in /var/log/logstash/logstash.err and no file /var/log/logstash/logstash.log.

What's the reason of this trouble?????

Thank you.

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 9, 2016, 3:21pm UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161/2 "2016-09-09T15:21:10Z")

</div>

Try running this command:

```auto
sudo /opt/logstash/bin/logstash -f /etc/logstash/conf.d/ex.conf --verbose

```

Then you'll know what's going on if `root` is running Logstash. It's likely a permissions issue with the `logstash` user not being able to write a file (perhaps one of the log files).

---

<div class="post-metadata">

### Author: ![sgm](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@sgm](https://discuss.elastic.co/u/sgm)
#### Post date: [September 11, 2016, 7:15pm UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161/3 "2016-09-11T19:15:31Z")

</div>

theuntergeek, thank yoy for your answer. I ran this command, but no any result - black screen.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f4afdc10306b5d9bcf20594990cec1ca70c13d71.png)

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 12, 2016, 11:47am UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161/4 "2016-09-12T11:47:12Z")

</div>

Please don't send configuration images. We can't select portions to paste back.

I do not know why you have commented out the cluster and node\_name portions of the elasticsearch output, but that is not helpful for troubleshooting.

Perhaps you should replace the elasticsearch output temporarily with a stdout block:

```auto
output {
  stdout { codec => rubydebug }
}

```

Re-run the sudo command as before, and if you still don't see output at the command-line, it will be because of something else.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/logstash-doesnt-read-config-from-etc-logstash-conf-d/60161/5 "2017-07-06T04:38:58Z")

</div>