Starting separate logstash pipeline incorrectly starts Logstash Service

[chris_ts24]

Hi all,

I've noticed recently that my Logstash service sometimes gets started for an unknown reason when I start a separate Logstash pipeline.

The expected behavior is that this single Logstash instance is started and the Logstash service is not started.

The actual behavior is that this single Logstash instance is started AND my Logstash service is also sometimes started.

More specifically, when I run the following command from my command line and my Logstash service is stopped, the Logstash instance runs a single time and the service is started:

/usr/share/logstash/bin/logstash -f /home/apps/logstash/config/create/logstash-ora.conf --path.settings /home/apps/logstash/config/create

The contents of logstash-ora.conf:

input {
    jdbc {
         jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
         jdbc_driver_library => "/usr/local/bin/ojdbc8.jar"
         jdbc_connection_string => "jdbc:oracle:thin:@<IP>:<PORT>:<SERVICE>"
         jdbc_user => "<USER>"
         jdbc_password => "<PASS>"
         statement_filepath => "home/apps/logstash/sql/get-all-records.sql"
     }
}

output {
     elasticsearch {
         hosts => ["localhost:9200"]
         index => "myIndex"
         document_type => "_doc"
         document_id => "%{record_id}"
     }
}

So, this pipeline is completely separate from the pipelines that I run in the service. Yet, somehow, the service sometimes gets started when I run this pipeline. The service is configured as:

[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings=/home/apps/logstash/config"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

TimeoutStopSec=infinity

[Install]
WantedBy=multi-user.target

The only overlap I see is that I call the pipeline using logstash from the same location as the service, but I see no reason why this should indicate to the service to start.

Has anyone noticed a similar issue? Any advice?

Thanks for reading!