Logstash6.5: It seems your ruby installation is missing psych

[kevink00]

Following steps exactly as noted here: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

I'm on CentOS 7.5 (3.10.0-862.14.4.el7.x86_64). New OS installed.

I've installed elasticsearch, kibana, logstash, filebeat --all from elasticsearch-6.x reposotiry. No configurations modified.

First issue:

export LS_SETTINGS_DIR=/etc/logstash
/usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2018-12-09T10:07:49,883][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (LoadError) Could not load FFI Provider: (NotImplementedError) FFI not available: java.lang.UnsatisfiedLinkError: /tmp/jffi2854495824092053690.so: /tmp/jffi2854495824092053690.so: failed to map segment from shared object: Operation not permitted
	at java.lang.ClassLoader$NativeLibrary.load(Native Method)
	at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1941)
	at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1824)
	at java.lang.Runtime.load0(Runtime.java:809)
	at java.lang.System.load(System.java:1086)

[ ... ]

Workaround:

/etc/logstash/jvm.options

# set the I/O temp directory
#-Djava.io.tmpdir=$HOME
-Djava.io.tmpdir=$HOME

While this allows me to run the simple command as noted in the 'Getting Started' docs, I'm unsure if this is the best approach. Please suggest a better solution if available.

Second issue:

Dec  9 09:17:08 narfy-2102 logstash: uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/rubygems/core_ext/kernel_require.rb:59:in `require':
Dec  9 09:17:08 narfy-2102 logstash: It seems your ruby installation is missing psych (for YAML output).
Dec  9 09:17:08 narfy-2102 logstash: To eliminate this warning, please install libyaml and reinstall your ruby.
Dec  9 09:17:08 narfy-2102 logstash: [ERROR] 2018-12-09 09:17:08.533 [main] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (GemspecError) There was a LoadError while loading logstash-core.gemspec:
Dec  9 09:17:08 narfy-2102 logstash: load error: psych -- java.lang.RuntimeException: BUG: we can not copy embedded jar to temp directory
Dec  9 09:17:08 narfy-2102 logstash: Does it try to require a relative path? That's been removed in Ruby 1.9.
Dec  9 09:17:08 narfy-2102 systemd: logstash.service: main process exited, code=exited, status=1/FAILURE
Dec  9 09:17:08 narfy-2102 systemd: Unit logstash.service entered failed state.
Dec  9 09:17:08 narfy-2102 systemd: logstash.service failed.
Dec  9 09:17:08 narfy-2102 systemd: logstash.service holdoff time over, scheduling restart.
Dec  9 09:17:08 narfy-2102 systemd: Started logstash.
Dec  9 09:17:08 narfy-2102 systemd: Starting logstash...

This appears every 20 seconds in /var/log/messages. The logstash process is very busy cpu. I have verified the following are installed:

libyaml-0.1.4-11.el7_0.x86_64
libyaml-devel-0.1.4-11.el7_0.x86_64
rubygem-psych-2.0.0-34.el7_6.x86_64
ruby-2.0.0.648-34.el7_6.x86_64

[danhermann]

@kevink00, this occurs when Logstash runs on a system where /tmp is mounted noexec. A number of Logstash dependencies copy jar files and other executables to the temp directory that are later executed. The proper resolution for this is what you identified -- setting the JVM temp directory to a directory that is both writable by the Logstash process and not mounted as noexec.