logstash启动失败解决

安装的是最新7.X系列首先要写repo文件

/etc/yum.repos.d/elasticsearch.repo
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=0
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

关闭了 gpgcheck ，测试不需要检查。

然后直接安装

yum -y install logstash

安装很慢需要耐心等，当然也可以从官方网站下载，我这里是yum安装

手动添加systemd服务

/usr/share/logstash/bin/system-install

完成后会创建脚本/etc/systemd/system/logstash.service

[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target

　启动

systemctl start logstash

　检查

systemctl status logstash

　发现错误，无法启动，查看系统日志tail -999f /var/log/messages

Sep 25 09:52:57 xh_nginx systemd: Started logstash.
Sep 25 09:52:57 xh_nginx systemd: Starting logstash...
Sep 25 09:52:57 xh_nginx logstash: could not find java; set JAVA_HOME or ensure java is in PATH
Sep 25 09:52:57 xh_nginx systemd: logstash.service: main process exited, code=exited, status=1/FAILURE
Sep 25 09:52:57 xh_nginx systemd: Unit logstash.service entered failed state.
Sep 25 09:52:57 xh_nginx systemd: logstash.service failed.
Sep 25 09:52:57 xh_nginx systemd: logstash.service holdoff time over, scheduling restart.
Sep 25 09:52:57 xh_nginx systemd: Cannot add dependency job for unit rpcbind.socket, ignoring: Unit not found.　

  报的错是无法找到java，原因是java 是手动tar安装的，而logstash默认配置文件去 /usr/bin、/bin、/sbin、/usr/sbin 找，所以无法找到，解决办法很多，我这里软连接解决的。

which java
ln -s /usr/src/java/bin/* /bin
或者在logstash 配置文件添加环境变量
/usr/share/logstash/bin/logstash.lib.sh
JAVA_HOME="/usr/src/java"

  这样一来他就会找到java环境了。

[root@xh_nginx sysconfig]# systemctl status logstash 
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2019-09-25 10:06:54 CST; 9s ago
 Main PID: 15468 (java)
    Tasks: 17
   Memory: 522.7M
   CGroup: /system.slice/logstash.service
           └─15468 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSIniti...