I downloaded the Logstash RPM logtsash-1.4.2-1_2c0f5a1.noarch from the official site, but have been having problems getting it to run from the init script.
I get no log data passed to Elasticsearch/Kibana unless I change the nice value (LS_NICE below) to 1 (by default it's set to 19).
nice -n ${LS_NICE} chroot --userspec $LS_USER:$LS_GROUP / sh -c "
cd $LS_HOME
ulimit -n ${LS_OPEN_FILES}
exec \"$program\" $args
" > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" &
Why am I getting no results at all when it's set to values in the range 2-19? I'm sure the answer is staring me in the face, but I can't see it.
EDIT: Additionally, whether I get logs visible in Elasticsearch/Kibana is a bit hit or miss, even when I set the nice value to 1 or 2.
However, if I run logstash on all servers as root at the command-line like this:
/opt/logstash/bin/logstash agent -f /etc/logstash/conf.d
... everything always runs fine.
EDIT2: These are the permissions for the directory that holds the logstash configuration files (the config files are owned by the logstash user)
[root@s100081 /]# ls -ld /etc
drwxr-xr-x. 101 root root 12288 Sep 17 16:13 /etc
[root@s100081 /]# ls -ld /etc/logstash
drwxr-xr-x 4 root root 4096 Sep 16 22:50 /etc/logstash
[root@s100081 /]# ls -ld /etc/logstash/conf.d/
drwxrwxr-x 2 root root 4096 Sep 17 00:08 /etc/logstash/conf.d/