I just set up a 3 node Elasticsearch and Logstash environment using the repos on RHEL 7:
I initially installed the X-Pack for ES and Kibana but then removed the plugins.
My problem is with starting Logstash on the 3 nodes. On two of the three nodes (node 1 and 3) I can start Logstash only via the command line with:
./logstash -f /etc/logstash/conf.d -l /var/log/logstash --log.level=debug --path.settings=/etc/logstash
Everything starts properly, logstash-plain.log is created, and the server begins to listen on port 5044.
I cannot however start Logstash properly via systemd (systemctl start logstash). When I attempt to start via systemd the 'logstash' process appears to start:
logstash 40191 1 99 22:24 ? 00:00:01 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
However, no log file is created in /var/log/logstash (as directed in logstash.yml: path.logs: /var/log/logstash), and the server does not begin listening on port 5044.
I have seen a couple posts a similar issue but no real resolution other than reinstalling the ELK stack.
On my other node (node 2), I cannot start Logstash either from the command line (same syntax as above) or systemd. It is having a problem finding java:
Could not find any executable java binary. Please install java in your PATH or set JAVA_HOME
I have also read several posts specific to this error and have confirmed JAVACMD in /etc/default/logstash:
Java is indeed located at /usr/bin/java:
openjdk version "1.8.0_141"
OpenJDK Runtime Environment (build 1.8.0_141-b16)
OpenJDK 64-Bit Server VM (build 25.141-b16, mixed mode)
I wasn't sure if I should separate these two issues or not, I can do so if it's preferred.
Any guidance is greatly appreciated.