Running logstash as a deamon

Elastic Stack Logstash
#1

I try to start logstash as a deamon but for some reason it does not seem to read my logstash.conf which I placed in /etc/logstash/conf.d/ What could be the reason?
When I run it like sudo bin/logstash -f ./logstash.conf all works fine

sudo service logstash status
ā— logstash.service - LSB: Starts Logstash as a daemon.
Loaded: loaded (/etc/init.d/logstash; bad; vendor preset: enabled)
Active: active (running) since Thu 2016-06-02 22:58:56 EDT; 9min ago
Docs: man:systemd-sysv-generator(8)
Process: 5198 ExecStart=/etc/init.d/logstash start (code=exited, status=0/SUCCESS)
Tasks: 20
Memory: 175.1M
CPU: 18.598s
CGroup: /system.slice/logstash.service
ā””ā”€5206 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOn

Jun 02 22:58:56 michal-ubuntu systemd[1]: Starting LSB: Starts Logstash as a daemon....
Jun 02 22:58:56 michal-ubuntu logstash[5198]: logstash started.
Jun 02 22:58:56 michal-ubuntu systemd[1]: Started LSB: Starts Logstash as a daemon..
Jun 02 23:08:07 michal-ubuntu systemd[1]: Started LSB: Starts Logstash as a daemon..
#2

I got same problem with my new installation, my all conf files dint work when i start the logstash as deamon (/etc/init.d/logstash start), but if i run it like "bin/logstash -f /etc/logstash/conf.d/" all works fine...
Its bug?
Following the /etc/init.d/logstash file (START SESSION).

start() {

LS_JAVA_OPTS="${LS_JAVA_OPTS} -Djava.io.tmpdir=${LS_HOME}"
HOME=${LS_HOME}
export PATH HOME LS_HEAP_SIZE LS_JAVA_OPTS LS_USE_GC_LOGGING LS_GC_LOG_FILE

chown doesn't grab the suplimental groups when setting the user:group - so we have to do it for it.

Boy, I hope we're root here.

SGROUPS=$(id -Gn "$LS_USER" | tr " " "," | sed 's/,$//'; echo '')

if [ ! -z $SGROUPS ]
then
EXTRA_GROUPS="--groups $SGROUPS"
fi

set ulimit as (root, presumably) first, before we drop privileges

ulimit -n ${LS_OPEN_FILES}

Run the program!

nice -n ${LS_NICE} chroot --userspec $LS_USER:$LS_GROUP $EXTRA_GROUPS / sh -c "
cd $LS_HOME
ulimit -n ${LS_OPEN_FILES}
exec "$program" $args
" > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" &

Generate the pidfile from here. If we instead made the forked process

generate it there will be a race condition between the pidfile writing

and a process possibly asking for status.

echo $! > $pidfile

echo "$name started."
return 0
}

#3

Any news about this?

#4

I found this topic, but no specific response yet Logstash don't read conf.d settings file when running as daemon

It may be some permission/ownership problem

#5

Daer mke

iIts running normal for me.
what i change (2 choices)

1 - You have to create a username/group called logstash
2 - Edit the file /etc/init.d/logstash and chance the options LS_USER=root and LS_GROUP=root

In my case, i made 2nd :wink:

To start the application with your SO you have to do this:
update-rc.d kibana defaults 95 10
update-rc.d logstash defaults 95 10
update-rc.d elasticsearch defaults 95 10

I guess Logstash team dev have to create the user/group when you install it by apt-get.

Rewards,
Alex

1 Like
#6

In my case all looks good out of the box but still does not seem to be reading confing files

Here is part of my logstash file you mentioned

name=logstash
pidfile="/var/run/$name.pid"

LS_USER=logstash
LS_GROUP=logstash
LS_HOME=/var/lib/logstash
LS_HEAP_SIZE="1g"
LS_LOG_DIR=/var/log/logstash
LS_LOG_FILE="${LS_LOG_DIR}/$name.log"
LS_CONF_DIR=/etc/logstash/conf.d
#LS_CONF_DIR=/opt/logstash/bin
LS_OPEN_FILES=16384
LS_NICE=19
KILL_ON_STOP_TIMEOUT=0
LS_OPTS=""

and just to make sure ownership is correct

ls -la /etc/logstash/conf.d/
total 12
drwxrwxr-x 2 root root 4096 Jun 6 10:47 .
drwxrwxr-x 3 root root 4096 Jun 4 08:00 ..
-rw-r--r-- 1 logstash logstash 2129 Jun 4 08:09 logstash.conf

#7

how i told you before.

if you edit the file /etc/init.d/logstash and chance:
LS_USER=logstash
LS_GROUP=logstash

to

LS_USER=root
LS_GROUP=root

your conf files on /etc/logstash/conf.d will work if you run logstash as a deamon

#8

With Ubuntu Logstash is started with the logstash user and group.
Logstash would also fail to start as a daemon but would start when run as root.

The problem here was that java was not allowed to bind to ports below 1024.
Have you checked that your input config is not listening to ports below 1024?
If so you can use this command to allow java to do so.

setcap 'cap_net_bind_service=+ep' /path/to/program

(the entire command in my case was: "sudo setcap 'cap_net_bind_service=+ep' /usr/lib/jvm/java-8-oracle/jre/bin/java")

Hope this helps.

2 Likes
[CLOSED ]Logstash crash after service start logstash
#9

Yup, that was what I needed, now it works not as a root but logstash. Yes indeed i was listening to port 514

#10