# Start Logstash as a service or a full binary path

**URL:** <https://discuss.elastic.co/t/start-logstash-as-a-service-or-a-full-binary-path/168628>\
**Category:** Logstash\
**Created:** [February 15, 2019, 6:13pm UTC](https://discuss.elastic.co/t/start-logstash-as-a-service-or-a-full-binary-path/168628 "2019-02-15T18:13:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rocky\_RK](https://avatars.discourse-cdn.com/v4/letter/r/ed655f/32.png) [@Rocky\_RK](https://discuss.elastic.co/u/Rocky_RK)\
**Post date:** [February 15, 2019, 6:13pm UTC](https://discuss.elastic.co/t/start-logstash-as-a-service-or-a-full-binary-path/168628/1 "2019-02-15T18:13:34Z")

</div>

Why i'm getting the different data while starting my Logstash as `systemctl stat logstash.service` and `/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --config.reload.automatic &`.

I i start the Service as service in Linux 7 then it starts and i see all the data feild for syslog while i start the Logstash with later ober with full path `/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --config.reload.automatic &` then it do not show all the fields.

I'm not getting any errors in log file ..

My Logstash file:  
Logstash version 6.5.4:

```
# cat /etc/logstash/conf.d/syslog.conf
input {
  file {
    path => ["/data/SYSTEMS/*/messages.log"]
    start_position => beginning
    sincedb_path => "/dev/null"
    max_open_files => 64000
    type => "sj-syslog"
 }
}

filter {
  if [type] == "sj-syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp } %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      remove_field => ["@version", "host", "path"]
      remove_tag => ["_grokparsefailure"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
  }
 }
}
output {
        if [type] == "sj-syslog" {
        elasticsearch {
                hosts => "hostdc02:9200"
                manage_template => false
                index => "sj-syslog-%{+YYYY.MM.dd}"
                document_type => "messages"
  }
 }
}

```

I see only:

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/effbb1100eeba5997efc89bc887dd80d65e741e6.png)

While remove check from hide missing then i see what are other fields missing..

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0bdd6dedea1466640b0e668f706b248382271ed.png)

When i stop the full path and then starting the logstash with service mode then all fields are back , Is there anything bad with my configuration..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2019, 6:13pm UTC](https://discuss.elastic.co/t/start-logstash-as-a-service-or-a-full-binary-path/168628/2 "2019-03-15T18:13:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.