# New installed Logstash not work as service

**URL:** <https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352>\
**Category:** Logstash\
**Created:** [November 28, 2016, 1:37pm UTC](https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352 "2016-11-28T13:37:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [November 28, 2016, 1:37pm UTC](https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352/1 "2016-11-28T13:37:51Z")

</div>

Hello!

I have installed Logstash 5 "yum install logstash" to same machine with elastic client node.  
Then create simple config:

# cat /etc/logstash/conf.d/nginx\_input.conf

```
 input {
    file {
          path => "/var/log/nginx/es.log"
    }
 }
output {
     elasticsearch {
           hosts => ["localhost:9200"]
     }
 }

```

Then test:

> # /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d
> 
> Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties

It's work: i can see logstash-2016.11.28 with documents. Logs in /var/log/messages

> Nov 28 08:30:17 hostname kibana: {"type":"response","@timestamp":"2016-11-28T13:30:17Z","tags": ... POST /elasticsearch/\_msearch 200 111ms - 9.0B"}

But then i say:# systemctl start logstash  
It starts.

> # tail /var/log/logstash/logstash-plain.log

> [2016-11-28T08:31:52,818][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["localhost:9200"]}  
> [2016-11-28T08:31:52,823][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
> [2016-11-28T08:31:52,825][INFO][logstash.pipeline] Pipeline main started  
> [2016-11-28T08:31:52,860][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

> # ps aux | grep logstash
> 
> logstash 18850 13.3 5.4 4734972 433064 ? SNsl 08:31 0:30 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash

But no new index in elastic.

> # cat /etc/logstash/logstash.yml
> 
> path.data: "/var/lib/logstash"  
> path.settings: "/etc/logstash"  
> path.config: "/etc/logstash/conf.d"  
> path.logs: "/var/log/logstash"

I think, logstash does not take configs from /etc/logstash/conf.d, but i do not know how fix this.  
May you help me?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2016, 1:46pm UTC](https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352/2 "2016-11-28T13:46:46Z")

</div>

Is new data arrived to the end of the log file you're monitoring? Does Logstash have read access to the file and all parent directories?

---

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [November 28, 2016, 1:51pm UTC](https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352/3 "2016-11-28T13:51:21Z")

</div>

Yes, data is arrived. o! yes. you are right ☹

# su - logstash -s /bin/bash

Last login: Mon Nov 28 08:49:36 EST 2016 on pts/0  
-bash-4.2$ ls /var/log/nginx/  
ls: cannot open directory /var/log/nginx/: Permission denied

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2016, 1:51pm UTC](https://discuss.elastic.co/t/new-installed-logstash-not-work-as-service/67352/4 "2016-12-26T13:51:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.