Running logstash as a deamon

With Ubuntu Logstash is started with the logstash user and group.
Logstash would also fail to start as a daemon but would start when run as root.

The problem here was that java was not allowed to bind to ports below 1024.
Have you checked that your input config is not listening to ports below 1024?
If so you can use this command to allow java to do so.

setcap 'cap_net_bind_service=+ep' /path/to/program

(the entire command in my case was: "sudo setcap 'cap_net_bind_service=+ep' /usr/lib/jvm/java-8-oracle/jre/bin/java")

Hope this helps.

2 Likes