# Logstash service problem

**URL:** <https://discuss.elastic.co/t/logstash-service-problem/249746>\
**Category:** Logstash\
**Created:** [September 24, 2020, 6:50am UTC](https://discuss.elastic.co/t/logstash-service-problem/249746 "2020-09-24T06:50:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vladpov](https://avatars.discourse-cdn.com/v4/letter/v/8c91f0/32.png) [@Vladpov](https://discuss.elastic.co/u/Vladpov)\
**Post date:** [September 24, 2020, 6:50am UTC](https://discuss.elastic.co/t/logstash-service-problem/249746/1 "2020-09-24T06:50:57Z")

</div>

Hey everyone!

I'm struggling with logstash running as a service. I have a couple of config files in /etc/logstash/conf.d/ and when I run my config by running this `bin/logstash -f /etc/logstash/conf.d/my.conf --path.settings /etc/logstash` command in CLI logstash works properly and sends logs to the output well parsed. Unfortunately, when I run logstash as service with `systemctl start logstash` it doesn't send any data to output and no errors are shown and seems to work correct.

My .conf file:

```
input {
  beats {
    port => 5044
  }
}

filter {

if "beats_input_codec_plain_applied" in [tags] {
mutate {
remove_tag => ["beats_input_codec_plain_applied"]
remove_field => ["beat"]
remove_field => ["prospector"]
remove_field => ["source"]
remove_field => ["host"]
}

}
       
 if "tag" in [tags] {      

  grok {
    match => { "message" => "%{SYSLOGTIMESTAMP} %{HOSTNAME:host} nginx\: %{IPORHOST:clientip} %{HTTPDUSER} %{USER} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{NOTSPACE} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} %{NUMBER:bytes} %{DATA} %{DATA}\" \(h=%{NOTSPACE:referrer} %{GREEDYDATA}"
    }
  }

  grok {
    match => { "message" => "%{SYSLOGTIMESTAMP} %{HOSTNAME:host} nginx\: %{IPORHOST:clientip} %{HTTPDUSER} %{EMAILADDRESS} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{NOTSPACE} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} %{NUMBER:bytes} %{DATA} %{DATA}\" \(h=%{NOTSPACE:referrer} %{GREEDYDATA}"
    }
  }

  grok {
    match => { "referrer" => "%{WORD:protocol}://%{NOTSPACE:domain3}\.%{NOTSPACE:domain2}\.%{WORD:domain1}:%{INT:port}"

    }
  }

  geoip {
    source => "clientip"
    add_field => {"longitude" => "%{[geoip][longitude]}"
                  "latitude" => "%{[geoip][latitude]}"
                  "timezone" => "%{[geoip][timezone]}"
                  "ip" => "%{[geoip][ip]}"
                  "continent_code" => "%{[geoip][continent_code]}"
                  "region_name" => "%{[geoip][region_name]}"
                  "postal_code" => "%{[geoip][postal_code]}"
                  "country_name" => "%{[geoip][country_name]}"
                  "region_code" => "%{[geoip][region_code]}"
                  "country_code3" => "%{[geoip][country_code3]}"
                  "geohash" => "%{[geoip][location]}"
    }
  }
 }
}

output {
 if "tag" in [tags] {
  stdout {codec => rubydebug}
  influxdb {
    host => "host"
    port => 8086
    db => "logstash"
    measurement => "test"
    codec => "json"
    use_event_fields_for_data_points => true
    send_as_tags => ["response", "host", "domain3", "domain2", "domain1", "referrer", "port", "protocol"]
    exclude_fields => ["@timestamp","timestamp","timestamp_object","timestamp_local","message","@version","geoip"]
  }
 }
}

```

logstash.service file:

```
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

# When stopping, how long to wait before giving up and sending SIGKILL?
# Keep in mind that SIGKILL on a process can cause data loss.
TimeoutStopSec=infinity

[Install]
WantedBy=multi-user.target

```

pipelines.yml file:

```
- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

```

Filebeat works well without any problems so there is problem somewhere in logstash...

Any help is appreciated!! Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-service-problem/249746/2 "2020-10-22T06:51:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.