Logstash service doesn't output logs, command line does

Elastic Stack Logstash
1

If I start the logstash service using service or systemctl, it starts and reports as running but produces no output that is seen by elasticsearch.

On the other hand, if I run logstash using

./bin/logstash -f /etc/logstash/conf.d/

it logs to the console and is picked up by elasticsearch

What am I missing?

2

Okay, I seem to have fixed this. There were a couple or three problems:

  1. In /etc/systemd/system/logstash.service,
    I had to change
    ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
    to
    ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/usr/share/logstash/config"

then
sudo systemctl daemon-reload

  1. The logging directory, /var/log/logstash was root:root and the logs therein were logstash:root so I chown'd both to logstash:logstash

  2. Logstash was trying to listen on 514 & 5514 which didn't work as the logstash user (no permission) so I used iptables to forward 514 to 5514, viz:

     sudo iptables -N PREROUTING
 sudo iptables -t nat -A PREROUTING -p UDP -m udp --dport 514 -j REDIRECT --to-ports 5514
 sudo iptables -t nat -A PREROUTING -p TCP -m tcp --dport 514 -j REDIRECT --to-ports 5514
 iptables-save

I think that was all.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.