Logstash process as startup process

[Kishore]

We are using logstash 2.1.1 version and running 5 different logstash process on RHEL, my concern is that whenever the servers goes down these process are getting stopped and these process are require to start manually when they started.

Kindly suggest me that ' how to add logstash process to the RHEL startup or suggest me the best approach'.

Thanks in Advance.

Regards
Kishore Uppala

[warkolm (Mark Walkom)]

This is an OS dependant thing, you should check the documentation for RHEL.

[Kishore]

Thanks Mark,

As you suggested, i am trying to work on OS level, but when i run the logstash service, it is getting stopped in the middle and throwing below error msg

 {:timestamp=>"2017-05-02T03:17:57.535000-0400", :message=>"You are using a deprecated config setting \"message_format\" set in file. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. You can achieve the same behavior with the 'line' codec If you have any questions about this, please visit the #logstash channel on freenode irc.", :name=>"message_format", :plugin=><LogStash::Outputs::File path=>"/opt/logstash/bruteforce.yml", message_format=>"%{src_ip}: login_failed">, :level=>:warn}
{:timestamp=>"2017-05-02T03:17:58.598000-0400", :message=>"Pipeline main started"}
{:timestamp=>"2017-05-02T03:17:58.703000-0400", :message=>"Pipeline main has been shutdown"}
{:timestamp=>"2017-05-02T03:18:01.604000-0400", :message=>"stopping pipeline", :id=>"main"}

Please help me out running logstash as service.

[warkolm (Mark Walkom)]

How did you install it, RPM, tar.gz?

[Kishore]

I installed through RPM.

[Xavy (Javier)]

For rpm package it should be enough with setting LS systemctl service entry to enabled (it is disabled by default).

If you ahve already done son (as it looks based on your logs), I would suggest checking out /var/log/logstash/* logs to look for the cause why it is not being able to start (have you made sure to have Java 8 installed?) I've recently found that jre is not set up as a dependency

[Kishore]

@Kishore

Pipeline main has been shutdown

Thanks Javier,

I have already pasted the logs from the mentioned location and java also installed. What might be the other issues.

[Xavy (Javier)]

Hi there:

Please increase log verbosity by uncomenting log.level: directive and set it to debug .
Uncommenting config.debug: directive might help as well.

Case did not printed anything else (or anything useful) I would suggest you running the java command by hand (which would be something like

/usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash

depending on your settings)