These days, I have been handling logs with FileBeat + Logstash. After installing the logstash, I am ready to start it. I skillfully pressed the start command systemctl start logstash. And then I get used to looking at status systemctl status logstash:


[root@spring-omega8 etc]# systemctl status logstashLow logstash. Service - logstash the Loaded: the Loaded (/ etc/systemd/system/logstash. Service; disabled; vendor preset: disabled) Active: failed (Result: start-limit) since Wed 2019-12-11 11:15:52 CST; 8s ago Process: 18593 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE) Main PID: 18593 (code=exited, status=1/FAILURE) Dec 11 11:15:52 spring-omega8 systemd[1]: Unit logstash.service entered failed state. Dec 11 11:15:52 spring-omega8 systemd[1]: logstash.service failed. Dec 11 11:15:52 spring-omega8 systemd[1]: logstash.service holdoff time over, scheduling restart. Dec 11 11:15:52 spring-omega8 systemd[1]: Stopped logstash. Dec 11 11:15:52 spring-omega8 systemd[1]: start request repeated too quicklyfor logstash.service
Dec 11 11:15:52 spring-omega8 systemd[1]: Failed to start logstash.
Dec 11 11:15:52 spring-omega8 systemd[1]: Unit logstash.service entered failed state.
Dec 11 11:15:52 spring-omega8 systemd[1]: logstash.service failed.

Copy the code

Notice a line of command:

/usr/share/logstash/bin/logstash --path.settings /etc/logstash
Copy the code

If you pull this one out and run it, the logstash starts.

Black question mark. JPG

There’s nothing to be done. Let’s check the log. The logs are in the /var/log/messages file.

Echo $JAVA_HOME echo $JAVA_HOME echo $JAVA_HOME echo $JAVA_HOME Note that I installed the JDK through the decompression package, not yum, so what’s the difference? So let’s see why we get this error.

Find the logstash. Lib. sh file in /usr/share/logstash/bin/

This means that when you start the logstash command from systemctl start the logstash command, it will be read from $JAVA_HOME/bin/ Java by default. If you install it from the unzip package, your JAVA_HOME configuration will not be read by the logstash command. So the error was reported. Here I did not investigate why my JAVA_HOME configuration did not work, nor did I test if this was the case with YUM installing the JDK.

Once the problem is found, it is easy to solve it. Simply add a line to the configuration file to configure JAVA_HOME=” your own JDK installation path like /usr/src/java” and restart.

Take a look at status:

In addition, as I mentioned in another article, the logstash default configuration file is /usr/bin, /bin, /sbin, /usr/sbin to find Java, which we cannot find by manually installing Java. You can solve this problem by creating a hard link in the Java directory to the /bin directory. I have not tried. Those who have tried it can comment on whether it was successful or not.