Logstash setting LS_JAVA_HOME

Elastic Stack Logstash
1

Hello again!

Before installing Logstash from the apt repo, I made sure java was installed and have set JAVA_HOME and LS_JAVA_HOME to /usr/bin/java as well as added /usr/bin/java to my path and verified java is installed. All output is below, plus log output under that.

It looks like Logstash is attempting to use the bundled java version from /usr/share/logstash/jdk

Is that because I need to create a config files in /etc/logstash/conf.d/ to override the above, or possible because I need to install a JDK (such as default-jdk) in addition to the default-jre install from apt?

locadmin@elk:~$ java -version
openjdk version "11.0.15" 2022-04-19
OpenJDK Runtime Environment (build 11.0.15+10-Ubuntu-0ubuntu0.20.04.1)
OpenJDK 64-Bit Server VM (build 11.0.15+10-Ubuntu-0ubuntu0.20.04.1, mixed mode, sharing)
locadmin@elk:~$ echo $PATH
/usr/bin/java:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
locadmin@elk:~$ echo $LS_JAVA_HOME
/usr/bin/java
locadmin@elk:~$ echo $JAVA_HOME
/usr/bin/java
locadmin@elk:~$ /usr/share/logstash/bin/logstash -v
Using LS_JAVA_HOME defined java: /usr/bin/java.
Invalid LS_JAVA_HOME, doesn't contain bin/java executable.
Could not find java; set LS_JAVA_HOME or ensure java is in PATH.

Jun 17 18:54:04 elk systemd[1]: Started logstash.
Jun 17 18:54:04 elk logstash[13017]: Using bundled JDK: /usr/share/logstash/jdk
Jun 17 18:54:04 elk logstash[13017]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Jun 17 18:54:21 elk logstash[13017]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
Jun 17 18:54:21 elk logstash[13017]: [2022-06-17T18:54:21,477][INFO ][logstash.runner          ] Log4j configuration path used is: /etc/logstash/log4j2.properties
Jun 17 18:54:21 elk logstash[13017]: [2022-06-17T18:54:21,519][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"8.2.3", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.1>
Jun 17 18:54:21 elk logstash[13017]: [2022-06-17T18:54:21,526][INFO ][logstash.runner          ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Dja>
Jun 17 18:54:23 elk logstash[13017]: [2022-06-17T18:54:23,661][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
Jun 17 18:54:23 elk logstash[13017]: [2022-06-17T18:54:23,676][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
Jun 17 18:54:23 elk logstash[13017]: [2022-06-17T18:54:23,744][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
Jun 17 18:54:28 elk logstash[13017]: [2022-06-17T18:54:28,894][INFO ][logstash.runner          ] Logstash shut down.
Jun 17 18:54:28 elk logstash[13017]: [2022-06-17T18:54:28,907][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit
Jun 17 18:54:28 elk logstash[13017]: org.jruby.exceptions.SystemExit: (SystemExit) exit
Jun 17 18:54:28 elk logstash[13017]:         at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby.jar:?]
Jun 17 18:54:28 elk logstash[13017]:         at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby.jar:?]
Jun 17 18:54:28 elk logstash[13017]:         at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:91) ~[?:?]
Jun 17 18:54:28 elk systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Jun 17 18:54:28 elk systemd[1]: logstash.service: Failed with result 'exit-code'.
Jun 17 18:54:29 elk systemd[1]: logstash.service: Scheduled restart job, restart counter is at 1.
Jun 17 18:54:29 elk systemd[1]: Stopped logstash.
2

logstash will use the bundled JDK unless LS_JAVA_HOME is set. The logic is here.

3

Right, I get that. But then where would I correctly set LS_JAVA_HOME? In a conf file inside of /etc/logstash/conf.d/? I'm just not seeing in the documentation where/how LS_JAVA_HOME gets set.

4

You would set it in the shell that calls logstash. Are you running it as a service?

5

Ah ok. Yes, I'm running it as a service via systemctl start logstash.service

I added LS_HOME_JAVA="/usr/bin/java" to /etc/defaults/logstash that gets logstash to use LS_JAVA_HOME but it still doesn't start.

Jun 17 21:10:11 elk systemd[1]: Started logstash.
Jun 17 21:10:11 elk logstash[14699]: Using LS_JAVA_HOME defined java: /usr/bin/java.
Jun 17 21:10:11 elk logstash[14699]: Invalid LS_JAVA_HOME, doesn't contain bin/java executable.
Jun 17 21:10:11 elk logstash[14699]: Could not find java; set LS_JAVA_HOME or ensure java is in PATH.
Jun 17 21:10:11 elk systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Jun 17 21:10:11 elk systemd[1]: logstash.service: Failed with result 'exit-code'.
Jun 17 21:10:11 elk systemd[1]: logstash.service: Scheduled restart job, restart counter is at 2.
Jun 17 21:10:11 elk systemd[1]: Stopped logstash.
6

On my system /usr/bin/java is a link to a java executable. You should be setting LS_JAVA_HOME to the base of the JRE directory tree. Something like /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.312.b07-1.amzn2.0.2.x86_64/jre, and logstash will then append bin/java to that.

7

My systems have multiple versions of java installed. Their homes or installed dirs are under /usr/lib/jvm. Yours may be different. In my example, java executable is found in:

# which java
/usr/lib/jvm/java-11/bin/java

Therefore, LS_JAVA_HOME is set to /usr/lib/jvm/java-11

# echo $LS_JAVA_HOME
/usr/lib/jvm/java-11
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.