When you installed via YUM, did you by any chance see a message like this?
Could not find any executable java binary. Please install java in your PATH or set JAVA_HOME.
In context, the entire output looks like:
Dependencies Resolved
===============================================================================================================================================================================================================================================================
Package Arch Version Repository Size
===============================================================================================================================================================================================================================================================
Installing:
logstash noarch 1:5.2.1-1 logstash-5.x 91 M
Transaction Summary
===============================================================================================================================================================================================================================================================
Install 1 Package
Total download size: 91 M
Installed size: 167 M
Is this ok [y/d/N]: y
Downloading packages:
logstash-5.2.1.rpm | 91 MB 00:00:07
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : 1:logstash-5.2.1-1.noarch 1/1
Could not find any executable java binary. Please install java in your PATH or set JAVA_HOME.
warning: %post(logstash-1:5.2.1-1.noarch) scriptlet failed, exit status 1
Non-fatal POSTIN scriptlet failure in rpm package 1:logstash-5.2.1-1.noarch
Verifying : 1:logstash-5.2.1-1.noarch 1/1
Installed:
logstash.noarch 1:5.2.1-1
This happens if a JAVA_HOME is not set when you run the yum install command.
When it is properly set, this is the result:
Transaction test succeeded
Running transaction
Installing : 1:logstash-5.2.1-1.noarch 1/1
Using provided startup.options file: /etc/logstash/startup.options
Successfully created system startup script for Logstash
Verifying : 1:logstash-5.2.1-1.noarch
After adding 3 config files (one input, one filter, one output, for the sake of file merge testing), it works for me:
[root@centos7-pkg-test conf.d]# systemctl start logstash
[root@centos7-pkg-test conf.d]# systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2017-02-21 18:48:32 UTC; 5s ago
Main PID: 1011 (java)
CGroup: /system.slice/logstash.service
└─1011 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx...
Feb 21 18:48:32 centos7-pkg-test.untergeek.net systemd[1]: Started logstash.
Feb 21 18:48:32 centos7-pkg-test.untergeek.net systemd[1]: Starting logstash...
[root@centos7-pkg-test conf.d]# ps auwwx | grep jav
logstash 1011 0.0 53.5 4102040 280764 ? SNsl 18:48 0:10 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
Note that you should not have to uninstall and reinstall with a JAVA_HOME exported. You can simply run:
export JAVA_HOME=/path/to/java_home
/usr/share/logstash/bin/system-install /etc/logstash/startup.options
This will regenerate the systemd startup files for you. Note: you don't actually need to provide startup.options, it will be automatically selected. I include it here so you know which file is being read.