0

I downloaded the Logstash RPM logtsash-1.4.2-1_2c0f5a1.noarch from the official site, but have been having problems getting it to run from the init script.

I get no log data passed to Elasticsearch/Kibana unless I change the nice value (LS_NICE below) to 1 (by default it's set to 19).

nice -n ${LS_NICE} chroot --userspec $LS_USER:$LS_GROUP / sh -c "
    cd $LS_HOME
    ulimit -n ${LS_OPEN_FILES}
    exec \"$program\" $args
  " > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" &

Why am I getting no results at all when it's set to values in the range 2-19? I'm sure the answer is staring me in the face, but I can't see it.

EDIT: Additionally, whether I get logs visible in Elasticsearch/Kibana is a bit hit or miss, even when I set the nice value to 1 or 2.

However, if I run logstash on all servers as root at the command-line like this:

/opt/logstash/bin/logstash agent -f /etc/logstash/conf.d

... everything always runs fine.

EDIT2: These are the permissions for the directory that holds the logstash configuration files (the config files are owned by the logstash user)

[root@s100081 /]# ls -ld /etc
drwxr-xr-x. 101 root root 12288 Sep 17 16:13 /etc
[root@s100081 /]# ls -ld /etc/logstash
drwxr-xr-x 4 root root 4096 Sep 16 22:50 /etc/logstash
[root@s100081 /]# ls -ld /etc/logstash/conf.d/
drwxrwxr-x 2 root root 4096 Sep 17 00:08 /etc/logstash/conf.d/
RCross
  • 449
  • 2
  • 6
  • 19
  • I don't recall it using `nice ... chroot --userspec ...` when I installed it a couple of months ago, but things do move on.... Does `${LS_LOG_DIR}/$name.err` have any output? What JVM are you using? – Cameron Kerr Sep 16 '14 at 11:29
  • Does it actually start when run with `nice -n 2` ? Try running it on a foreground command-line with output going to stdout (you might like to use `rubycodec`) and see if you get any output. – Cameron Kerr Sep 16 '14 at 11:31
  • Runs fine in foreground (as root). It starts no matter which nice level I pass it, but no output ever reaches Elasticsearch/Kibana. – RCross Sep 16 '14 at 15:15
  • ${LS_LOG_DIR}/$name.err (/var/log/logstash/logstash.err) is empty – RCross Sep 16 '14 at 15:16
  • What Os/release are you running? – Cameron Kerr Sep 16 '14 at 18:33
  • Can you please stop logstash, change the `sh -c` to `bash -x -c` then send us the output of `service logstash start`. Also, which file are you putting your config into? Can you show us the permissions etc for that as well as for its parent? – Cameron Kerr Sep 16 '14 at 18:38
  • OS is Red Hat Enterprise Linux Server release 6.4 (Santiago). I made the modifications to the script as suggested, but no interesting output that indicates an error. As for the permissions of the config, all files are owned by the logstash user, and sitting under /etc/logstash/conf.d - /etc, /etc/logstash and /etc/logstash/conf.d are owned by root, but all have r-x set for everyone. – RCross Sep 17 '14 at 11:15
  • Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/17228/discussion-between-rcross-and-cameron-kerr). – RCross Sep 17 '14 at 11:26

0 Answers0