# Setting Logstash to run as a service and start on reboot

**URL:** <https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353>\
**Category:** Logstash\
**Created:** [February 14, 2019, 7:56am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353 "2019-02-14T07:56:04Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![bradfordaemorton](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\
**Post date:** [February 14, 2019, 7:56am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/1 "2019-02-14T07:56:04Z")

</div>

When I log out of an interactive terminal Filebeat and Logstash seem to run in the foreground and stop. Elasticsearch and Kibana services are running OK. This just might be that my Linux fu is not up to scratch but how do I get Logstash and Filebeat to run as a service and start on reboot.

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 14, 2019, 9:40am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/2 "2019-02-14T09:40:09Z")

</div>

Hi @bradfordaemorton,

how have you installed Filebeat and Logstash and how do you start them? Also, which OS are you using?

---

<div class="post-metadata">

**Author:** ![bradfordaemorton](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\
**Post date:** [February 14, 2019, 7:52pm UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/3 "2019-02-14T19:52:04Z")

</div>

Thanks A\_B,

I am running Ubuntu.

Install process is below:

**Logstash**

java –version

sudo apt install default-jre

java –version

wget -qO - [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) sudo apt-key add -

sudo apt-get install apt-transport-https

echo "deb [https://artifacts.elastic.co/packages/6.x/apt](https://artifacts.elastic.co/packages/6.x/apt) stable main" sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list

sudo apt-get update && sudo apt-get install logstash

cd /etc/logstash/

echo “” \> first-pipeline.conf

sudo vim first-pipeline.conf

_input {_

_beats {_

_port =\> "5044"_

_}_

_}_

_filter {_

_grok {_

_match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}_

_}_

_geoip {_

_source =\> "clientip"_

_}_

_}_

_output {_

_elasticsearch {_

_hosts =\> ["localhost:9200"]_

_}_

_}_

cd /usr/share/ logstash /bin

./logstash -f /etc/logstash/first-pipeline.conf --config.test\_and\_exit

./logstash -f /etc/logstash/first-pipeline.conf --config.reload.automatic

**Filebeats**

wget -qO - [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) | sudo apt-key add –

sudo apt-get install apt-transport-https

echo "deb [https://artifacts.elastic.co/packages/6.x/apt](https://artifacts.elastic.co/packages/6.x/apt) stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list

sudo apt-get update && sudo apt-get install filebeat

sudo update-rc.d filebeat defaults 95 10

cd /etc/filebeat/

echo “” \> filebeat1.yml

sudo vim filebeat1.yml

_filebeat.prospectors:_

_- type: log_

_paths:_

_- /path/to/file/logstash-tutorial.log_

_output.logstash:_

_hosts: ["hostname:5044"]_

cd /usr/share/filebeat/bin

sudo ./filebeat -e -c /etc/filebeat/filebeat1.yml -d "publish"

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 15, 2019, 8:27am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/4 "2019-02-15T08:27:08Z")

</div>

You are definitely starting them in the foreground 😃

As you install with apt-get you should get SystemD unit files created (at least on Debian, I think Ubuntu is the same these days).

So if you start Filebeat and Logstash with `systemctl start` they will start as services in the background

e.g.

```
# systemctl start logstash.service
# systemctl status logstash.service
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2019-02-05 16:09:51 UTC; 1 weeks 2 days ago
 Main PID: 27033 (java)
    Tasks: 137 (limit: 4915)
   CGroup: /system.slice/logstash.service
           └─27033 /usr/bin/java -Dfile.encoding=UTF-8 -Djava.awt.headless=true -XX:+DisableExplicitGC -XX:+HeapDumpOnOutOfMemoryError -XX:+UseCMSInitiatingOccupancyOnly -XX:+UseC

```

You will have to put your configuration files where the unitfile expects them though

e.g. for Logstash

```
# cat /etc/systemd/system/logstash.service
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings=/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=102400

[Install]
WantedBy=multi-user.target

```

Note `--path.settings=/etc/logstash`. I think the default location for the logstash conf file is `/etc/logstash/logstash.conf` (that might be wrong though).

Same goes for Filebeat.

Just to add... I have my Logstash conf in three separate files

```
# find /etc/logstash/conf.d/
/etc/logstash/conf.d/
/etc/logstash/conf.d/input
/etc/logstash/conf.d/output
/etc/logstash/conf.d/filter

```

And use them with the SystemD unit file above. There should be no other _magic_ going on.

And for good measure the Filebeat unit file (should be the stock file as far as I know)

```
# cat /etc/systemd/system/multi-user.target.wants/filebeat.service
[Unit]
Description=filebeat
Documentation=https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Wants=network-online.target
After=network-online.target

[Service]
ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
Restart=always

[Install]
WantedBy=multi-user.target

```

So put your Filebeat configuration in `/etc/filebeat/filebeat.yml` and start Filebeat with

```
# systemctl start filebeat.service
```

---

<div class="post-metadata">

**Author:** ![bradfordaemorton](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\
**Post date:** [February 15, 2019, 9:51am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/5 "2019-02-15T09:51:05Z")

</div>

Thanks for the help. The problems seems to be isolated to logstash - filebeats, elastic and kibana all reboot and start services successfully.

The behaviour I notice is after a reboot the logstash service doesn't start and if manually start the service no data is sent to elastic or visible in Kibana. Maybe it is reading the wrong configuration files?

I can run the following command and it all works: /usr/share/logstash/bin# ./logstash -f /etc/logstash/logstash.yml --config.reload.automatic

Status of logstash service is below:  
/usr/share/logstash/bin# systemctl status logstash.service  
● logstash.service - logstash  
Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset  
Active: active (running) since Fri 2019-02-15 09:38:55 UTC; 1s ago  
Main PID: 19565 (java)  
Tasks: 13 (limit: 2361)  
CGroup: /system.slice/logstash.service  
└─19565 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMark

Feb 15 09:38:55 ubuntu-s-1vcpu-2gb-sgp1-01 systemd[1]: logstash.service: Service  
Feb 15 09:38:55 ubuntu-s-1vcpu-2gb-sgp1-01 systemd[1]: logstash.service: Schedul  
Feb 15 09:38:55 ubuntu-s-1vcpu-2gb-sgp1-01 systemd[1]: Stopped logstash.  
Feb 15 09:38:55 ubuntu-s-1vcpu-2gb-sgp1-01 systemd[1]: Started logstash.

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 15, 2019, 10:07am UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/6 "2019-02-15T10:07:53Z")

</div>

> [@bradfordaemorton](#):
>
> /etc/logstash/logstash.yml

The Logstash config file is not YAML... What happens is you name it `/etc/logstash/logstash.conf` or `/etc/logstash/logstash.d/input`?

---

<div class="post-metadata">

**Author:** ![bradfordaemorton](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\
**Post date:** [February 15, 2019, 9:02pm UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/7 "2019-02-15T21:02:37Z")

</div>

OK, I did some more investigation. I have managed to get the service to start and start automatically on reboot. I had to set the service to enable.

I still have a problem as the service constantly restarts and never sends data elasticsearch. There must be a bad config or a file missing.

I did a bit of reading and found that the .conf files are meant to be in /etc/logstash/conf.d but I still have issues. Is there a log file to check for errors? Also, is there a place to download the default .yml and .conf files located in the /etc/logstash/ directory?

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [February 18, 2019, 1:52pm UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/8 "2019-02-18T13:52:00Z")

</div>

I don't think there are any default config files for Logstash...

Start as minimal as possible

Input

```
input {
  beats {
    port => 5044
  }
}

```

Filter

```
filter {}

```

Output

```
output {
  elasticsearch {
        hosts => ["10.1.1.1:9200", "10.1.1.2:9200"]
        index => "logstash-%{+YYYY.MM.dd}"
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2019, 1:52pm UTC](https://discuss.elastic.co/t/setting-logstash-to-run-as-a-service-and-start-on-reboot/168353/9 "2019-03-18T13:52:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.