# Logstash sysconfig file missing **URL:** \ **Category:** Logstash\ **Created:** [February 6, 2017, 7:51pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115 "2017-02-06T19:51:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 6, 2017, 7:51pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/1 "2017-02-06T19:51:48Z")
Hi, I've been reading many posts about adjusting /etc/sysconfig/logstash or /etc/init.d/logstash files for some settings. I can't find any of those files in any of those directories. When I start Logstash it works. Moreso, I can't stop it. funny right? Every time I issue stop command it continues to send logs. I was working on logstash.conf and ended up deleting the file. What do I see in Kibana?! Logs just as they've been before I made any changes. Even after I kill all of the Logstash processes, it is still there. Can anyone suggest why I don't find those files? And what is up with Logstash?! Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 6, 2017, 8:05pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/2 "2017-02-06T20:05:37Z")
How did you install Logstash? How are you starting Logstash? ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 6, 2017, 9:44pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/3 "2017-02-06T21:44:44Z")
Sorry for skipping that info. I installed it on RHEL 6 using repository (sudo install..) not via rpm package . When I start it I do "sudo initctl start logstash". It starts but no logs parsed to elasticsearch. And log files in /var/log are empty. When I do "sudo /bin/logstash -f /etc/logstash/conf.d/logstash.conf" it starts and I see logs coming in. I tried to configure it for autostart and it wouldn't work. Seems that the only way to start it is by issuing g above command "sudo /bin/logstash..." That's when it keeps sending logs even when I issue "sudo initctl stop logstash" or if I kill the process. I'm a bit confused. And I couldn't find the sysconfig file or one in init.d. I see ones for elasticsearch but not logstash. I tried to set logs to verbose. Thanks for assistance. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 7, 2017, 8:37am UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/4 "2017-02-07T08:37:17Z")
Unless you know what you're doing I suggest you use the RPM package. ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 7, 2017, 12:55pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/5 "2017-02-07T12:55:26Z")
Weird, as it was working before. It just had some weird behavior. Is there a way to correct the current install? I followed the documentation on this page - [https://www.elastic.co/guide/en/logstash/current/installing-logstash.html](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html) - and would like to know where I went wrong. Thanks again ---
**Author:** ![Rinat](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Post date:** [February 7, 2017, 5:42pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/6 "2017-02-07T17:42:58Z")
I created new test vm using RHEL 7 and installed ELK stack again following the documentation. I'm experiencing the same issue. Logstash starts but I can't locate those files. Those are the commands I used : rpm --import [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) ###Add the following in your /etc/yum.repos.d/ directory in a file with a .repo suffix, for example logstash.repo [logstash-5.x] name=Elastic repository for 5.x packages baseurl=https://artifacts.elastic.co/packages/5.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md sudo yum install logstash sudo systemctl start logstash.service ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2017, 5:43pm UTC](https://discuss.elastic.co/t/logstash-sysconfig-file-missing/74115/7 "2017-03-07T17:43:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.