一次logstash 启动，linux分析解决问题
1.官网上下载logstash 6.5.4.npm包之后，添加到yum仓库；
2.使用yum install logstash 安装npm包，包安装成功，查看systemctl status logstash 任务启动失败
[root@worker1 ~]# service logstash status Redirecting to /bin/systemctl status logstash.service ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled) Active: failed (Result: start-limit) since Thu 2019-01-17 11:03:03 CST; 1 day 23h ago Process: 5848 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE) Main PID: 5848 (code=exited, status=1/FAILURE) Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart. Jan 17 11:03:03 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service Jan 17 11:03:03 worker1.n1 systemd[1]: Failed to start logstash. Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed.
3. 单独启动logstash，/usr/share/logstash/bin/logstash --path.settings /etc/logstash ，logstash可以正常启动，所以判断为启动项的问题，
查看systemctl的启动项，/etc/systemd/system/logstash.service
[root@worker1 ~]# vi /etc/systemd/system/logstash.service [Unit] Description=logstash [Service] Type=simple User=logstash Group=logstash # Load env vars from /etc/default/ and /etc/sysconfig/ if they exist. # Prefixing the path with '-' makes it try to load, but if the file doesn't # exist, it continues onward. EnvironmentFile=-/etc/default/logstash EnvironmentFile=-/etc/sysconfig/logstash ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" Restart=always WorkingDirectory=/ Nice=19 LimitNOFILE=16384 [Install] WantedBy=multi-user.target
以为是权限问题，更改user，group为root， 执行 systemctl daemon-reload 让配置生效
重新启动logstash，
systemctl start logstash 查看 systemctl status logstash，
依旧不能以服务的方式启动
4.使用journalctl -ex 查看，发现没有指定JAVA_HOME,
Jan 19 10:17:15 worker1.n1 logstash[28297]: could not find java; set JAVA_HOME or ensure java is in PATH Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE Jan 19 10:17:15 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service failed. Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart. Jan 19 10:17:15 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service Jan 19 10:17:15 worker1.n1 systemd[1]: Failed to start logstash. -- Subject: Unit logstash.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit logstash.service has failed
echo $JAVA_HOME, 查看本地env都有配置，可能是logstash启动的时候没有读取到系统的JAVA_HOME环境；
5.在logstash 以server启动的时候加入启动项JAVA_HOME
vi /etc/sysconfig/logstash
增加JAVA_HOME路径
6.改回vi /etc/sysconfig/logstash的权限为初始的logstash，重启logstash，服务可以正常启动了
● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled) Active: active (running) since Sat 2019-01-19 10:21:24 CST; 4s ago Main PID: 26014 (java) CGroup: /system.slice/logstash.service └─26014 /usr/local/jdk/latest/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compi...
