Unable to start Logstash as a service. Errors with: Unable to locate required config /etc/logstash/logstash.conf

Elastic Stack Logstash
1

Hi,

On RHEL7 I'm able to run logstash v 7.17 directly as root like so:

logstash -f /home/maiky/first-pipeline.conf --config.reload.automatic

However when trying to run it as a service, I get the following error:

Job for logstash.service failed because the control process exited with error code. See "systemctl status logstash.service" 

# systemctl status logstash
Jan 12 06:07:04 namwrncld869.nam.nsroot.net logstash[21522]: ls: cannot access /opt/jre: No such file or directory
Jan 12 06:07:04 namwrncld869.nam.nsroot.net logstash[21522]: ln: failed to create symbolic link ‘/opt/jre/latest’: No such file or directory
Jan 12 06:07:04 namwrncld869.nam.nsroot.net logstash[21522]: Unable to locate required config /etc/logstash/logstash.conf
Jan 12 06:07:04 namwrncld869.nam.nsroot.net systemd[1]: logstash.service: control process exited, code=exited status=1

I've found the logstash.conf file located here: /opt/logstash/installer/templates/yml/logstash.conf

No idea if that's the right file as a commenter on a different post (Logstash.conf not found for after installing logstash) stated that logstash doesn't ship with a logstash.conf file.

In any case, I symlinked to that file and then started logstash. It appears to be running now, but it's not working correctly:

# systemctl status logstash
● logstash.service - LSB: This service manages the elasticsearch daemon
   Loaded: loaded (/etc/rc.d/init.d/logstash; bad; vendor preset: disabled)
   Active: active (exited) since Fri 2024-01-12 06:13:12 EST; 25s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 32234 ExecStart=/etc/rc.d/init.d/logstash start (code=exited, status=0/SUCCESS)

Jan 12 06:13:06 host869.net systemd[1]: Starting LSB: This service manages the elasticsearch daemon...
Jan 12 06:13:06 host869.net logstash[32234]: ls: cannot access /opt/jre: No such file or directory
Jan 12 06:13:06 host869.net logstash[32234]: ln: failed to create symbolic link ‘/opt/jre/latest’: No such file or directory
Jan 12 06:13:06 host869.net logstash[32234]: cat: /opt/elasticsearch-util/config/jfrog: No such file or directory
Jan 12 06:13:06 host869.net logstash[32234]: chown: invalid user: ‘%fid%:%fid%’
Jan 12 06:13:07 host869.net logstash[32234]: su: user %fid% does not exist

Any idea why it's not starting up correctly? I understand it attempts to run as logstash user, could there perhaps be an SELinux policy preventing it from running as that user?

2

Hi,

The error "ls: cannot access /opt/jre: No such file or directory" suggests that Logstash is unable to find the Java Runtime Environment (JRE) in the expected location. Logstash requires Java to run, so you need to ensure that Java is installed and accessible. You might need to set the JAVA_HOME environment variable to point to your Java installation.

If your configuration file is located elsewhere, you need to update the Logstash service file to point to the correct location.

Logstash runs as the 'logstash' user. You need to ensure that this user exists and has the necessary permissions.

Regards

3

Hmm, but if the problem is that it can't find the JRE, then why would it work when logstash is run manually?

Furthermore, the status of the service after having pointed to logstash.conf is one of active, i.e. it has managed to come up, which suggests to me that the JRE isn't the problem.

4

By default logstash uses the bundled JDK, which is surely not under /opt/jre. Perhaps when it is run as a service JAVA_HOME is getting set to that value.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.