Logstash Keystore While Running As A Service

[ankitdevnalkar]

Hello Team, I have created Logstash Keystore with command sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create but while running /usr/share/logstash/bin/logstash-keystore list it is throwing Can not find Logstash keystore at /usr/share/logstash/config/logstash.keystore. Please verify this file exists and is a valid Logstash keystore. I am a bit confused by the documentation given and not sure what to do! any help would be highly appreciated

Questions :

1. Do I need to pass --path.settings flag every time interacting with keystore?

   • If yes, what will happen when I run Logstash as a service?

2. What are the recommendations to interact with keystore smoothly as possible?

[Badger]

@ankitdevnalkar

Do I need to pass --path.settings flag every time interacting with keystore?

If you want a non-default value for path.settings then you need to set it every time, yes. That includes setting it on the command that the service manager uses to start logstash.

The default depends on the way logstash was installed. For RPM packages it is /etc/logstash, for Docker images it is /usr/share/logstash/config, etc.

[ankitdevnalkar]

I installed Logstsh via apt-get package.

@Badger

That includes setting it on the command that the service manager uses to start Logstash.

You mean, I will need to run with the following command?
service logstash start --path.settings /etc/logstash

[Badger]

@ankitdevnalkar

You mean, I will need to run with the following command?
service logstash start --path.settings /etc/logstash

No, I mean that the logstash init script (probably in /etc/init.d if you are running the sysvinit-utils service command) should include --path.settings when it invokes logstash.

[ankitdevnalkar]

I am running Logstash as systemd , I can see path.settings available in configuration file :

However, when I run /usr/share/logstash/bin/logstash-keystore list, it is giving me following error :

OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
2021-06-30 15:05:19,157 main ERROR Unable to locate appender "${sys:ls.log.format}_console" for logger config "root"
2021-06-30 15:05:19,158 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
2021-06-30 15:05:19,158 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling_slowlog" for logger config "slowlog"
2021-06-30 15:05:19,159 main ERROR Unable to locate appender "${sys:ls.log.format}_console_slowlog" for logger config "slowlog"
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults

[Badger]

OK, so the service should be OK, but you will still need to set it on the command line when running other logstash tools.