I have setup logstash together with Filebeat on Raspberry Pi and found another stumbling block:
Apr 19 13:49:32 raspberrypi logstash[22454]: org/jruby/RubyKernel.java:984: warning: It seems your ruby installation is missing psych (for YAML output).
Apr 19 13:49:32 raspberrypi logstash[22454]: To eliminate this warning, please install libyaml and reinstall your ruby.
Apr 19 13:49:32 raspberrypi logstash[22454]: [ERROR] 2019-04-19 13:49:32.960 [main] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (GemspecError)
Apr 19 13:49:32 raspberrypi logstash[22454]: [!] There was an error while loading logstash-core-plugin-api.gemspec: load error: psych -- java.lang.RuntimeException: BUG: we can not copy embedded jar to temp directory
Apr 19 13:49:32 raspberrypi logstash[22454]: Does it try to require a relative path? That's been removed in Ruby 1.9. Bundler cannot continue.
Apr 19 13:49:33 raspberrypi systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
Apr 19 13:49:33 raspberrypi systemd[1]: Unit logstash.service entered failed state.
Apr 19 13:49:33 raspberrypi systemd[1]: logstash.service holdoff time over, scheduling restart.
Apr 19 13:49:33 raspberrypi systemd[1]: Stopping logstash...
Apr 19 13:49:33 raspberrypi systemd[1]: Starting logstash...
Apr 19 13:49:33 raspberrypi systemd[1]: Started logstash.
I have tried reinstalling ruby and also libyaml but to no avail. Found that it could be related to /tmp but permissions should be fine. Any further thoughts?