# "service logstash start" does not work **URL:** \ **Category:** Logstash\ **Created:** [April 20, 2017, 7:48am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002 "2017-04-20T07:48:49Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 7:48am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/1 "2017-04-20T07:48:49Z")
Hi, I have Ubuntu 16.10 and the latest Logstash installed. Running Logstash manually with **/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"** works just fine but I'm unable to run it as a service. Any help would be greatly appreciated. Thanks, X ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 20, 2017, 7:49am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/2 "2017-04-20T07:49:06Z")
What do the logs say? ---
**Author:** ![pablosan](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@pablosan](https://discuss.elastic.co/u/pablosan)\ **Post date:** [April 20, 2017, 7:49am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/3 "2017-04-20T07:49:49Z")
check what sudo services logstash status says It will usually explain why the service didn't start ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 7:51am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/4 "2017-04-20T07:51:14Z")
logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: Active: active (running) since Thu 2017-04-20 10:49:23 IDT; 1min 24s ago Main PID: 5036 (java) Tasks: 17 (limit: 4915) Memory: 315.5M CPU: 24.560s CGroup: /system.slice/logstash.service └─5036 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMS Apr 20 10:49:23 PRIL1ELK02 systemd[1]: Started logstash. ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 8:01am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/5 "2017-04-20T08:01:18Z")
Even though it shows as being running...well, it just does not. it does not load my beats config file unless I run it manually. And the logs are NOT being written to. Only showing stuff when the manual command is being run. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 20, 2017, 8:02am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/6 "2017-04-20T08:02:07Z")
That doesn't look like the LS log, from `/var/log/logstash/`? ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 8:04am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/7 "2017-04-20T08:04:05Z")
/var/log/logstash/ does not show anything when running the "service logstash start" command. ---
**Author:** ![pablosan](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@pablosan](https://discuss.elastic.co/u/pablosan)\ **Post date:** [April 20, 2017, 8:11am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/8 "2017-04-20T08:11:07Z")
Check where your logstash.conf is [https://www.elastic.co/guide/en/logstash/current/running-logstash.html](https://www.elastic.co/guide/en/logstash/current/running-logstash.html) maybe is not picking it up ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 8:17am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/9 "2017-04-20T08:17:49Z")
You mean logstash.yml or the beats.conf? logstash.yml is at /etc/logstash beats.conf /etc/logstash/conf.d ---
**Author:** ![pablosan](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@pablosan](https://discuss.elastic.co/u/pablosan)\ **Post date:** [April 20, 2017, 8:36am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/10 "2017-04-20T08:36:56Z")
I meant logstash.conf check your systemd config (if you are using systemd) should be in /etc/systemd/system and will look like [this](https://github.com/rtznprmpftl/systemd-initfiles/blob/master/logstash.service) where you will have the location of the logstash.conf ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 9:18am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/11 "2017-04-20T09:18:00Z")
I found the following: root@PRIL1ELK02:/etc/systemd/system# cat logstash.service [Unit] Description=logstash [Service] Type=simple User=logstash Group=logstash # Load env vars from /etc/default/ and /etc/sysconfig/ if they exist. # Prefixing the path with '-' makes it try to load, but if the file doesn't # exist, it continues onward. EnvironmentFile=-/etc/default/logstash EnvironmentFile=-/etc/sysconfig/logstash EnvironmentFile=-/etc/logstash/startup.options ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" Restart=always WorkingDirectory=/ Nice=19 LimitNOFILE=16384 [Install] WantedBy=multi-user.target ---
**Author:** ![pablosan](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@pablosan](https://discuss.elastic.co/u/pablosan)\ **Post date:** [April 20, 2017, 10:02am UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/12 "2017-04-20T10:02:02Z")
I am not completely sure about this, but the ExecStart should point to your logstash.conf file also, something like: `ExecStart=/usr/share/logstash/bin/logstash "-f /etc/logstash/logstash.conf" "--path.settings" "/etc/logstash"` ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 20, 2017, 12:15pm UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/13 "2017-04-20T12:15:14Z")
I do not have a "logstash.conf" file anywhere. ---
**Author:** ![pablosan](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@pablosan](https://discuss.elastic.co/u/pablosan)\ **Post date:** [April 20, 2017, 7:01pm UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/14 "2017-04-20T19:01:49Z")
Oh well, that explains a lot 😄 make sure to have one if you want Logstash to do something. ---
**Author:** ![X\_Calibur](https://avatars.discourse-cdn.com/v4/letter/x/b2d939/32.png) [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Post date:** [April 24, 2017, 12:12pm UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/15 "2017-04-24T12:12:38Z")
Not really. I think what you refer to as "logstash.conf" is my "beats.conf". Anyway just came to say that my problem all long was permissions. /etc/logstash was taken by root ever since I installed Xpack I believe. Now the service works as it should. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 22, 2017, 12:24pm UTC](https://discuss.elastic.co/t/service-logstash-start-does-not-work/83002/16 "2017-05-22T12:24:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.