- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Upgrading Logstash
- Configuring Logstash
- Advanced Logstash Configurations
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Queues and data resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring Logstash with APIs
- Working with plugins
- Integration plugins
- Input plugins
- azure_event_hubs
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elastic_agent
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_cloud_storage
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- java_generator
- java_stdin
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- s3-sns-sqs
- salesforce
- snmp
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- dynatrace
- elastic_app_search
- elastic_workplace_search
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_cloud_storage
- google_pubsub
- graphite
- graphtastic
- http
- influxdb
- irc
- java_stdout
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sink
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- age
- aggregate
- alter
- bytes
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- http
- i18n
- java_uuid
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- memcached
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- threats_classifier
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- wurfl_device_detection
- xml
- Codec plugins
- Tips and best practices
- Troubleshooting
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- How to write a Logstash output plugin
- Logstash Plugins Community Maintainer Guide
- Document your plugin
- Publish your plugin to RubyGems.org
- List your plugin
- Contributing a patch to a Logstash plugin
- Extending Logstash core
- Contributing a Java Plugin
- Glossary of Terms
- Breaking Changes
- Release Notes
- Logstash 7.17.27 Release Notes
- Logstash 7.17.26 Release Notes
- Logstash 7.17.25 Release Notes
- Logstash 7.17.24 Release Notes
- Logstash 7.17.23 Release Notes
- Logstash 7.17.22 Release Notes
- Logstash 7.17.21 Release Notes
- Logstash 7.17.20 Release Notes
- Logstash 7.17.19 Release Notes
- Logstash 7.17.18 Release Notes
- Logstash 7.17.17 Release Notes
- Logstash 7.17.16 Release Notes
- Logstash 7.17.15 Release Notes
- Logstash 7.17.14 Release Notes
- Logstash 7.17.13 Release Notes
- Logstash 7.17.12 Release Notes
- Logstash 7.17.11 Release Notes
- Logstash 7.17.10 Release Notes
- Logstash 7.17.9 Release Notes
- Logstash 7.17.8 Release Notes
- Logstash 7.17.7 Release Notes
- Logstash 7.17.6 Release Notes
- Logstash 7.17.5 Release Notes
- Logstash 7.17.4 Release Notes
- Logstash 7.17.3 Release Notes
- Logstash 7.17.2 Release Notes
- Logstash 7.17.1 Release Notes
- Logstash 7.17.0 Release Notes
- Logstash 7.16.3 Release Notes
- Logstash 7.16.2 Release Notes
- Logstash 7.16.1 Release Notes
- Logstash 7.16.0 Release Notes
- Logstash 7.15.2 Release Notes
- Logstash 7.15.1 Release Notes
- Logstash 7.15.0 Release Notes
- Logstash 7.14.2 Release Notes
- Logstash 7.14.1 Release Notes
- Logstash 7.14.0 Release Notes
- Logstash 7.13.4 Release Notes
- Logstash 7.13.3 Release Notes
- Logstash 7.13.2 Release Notes
- Logstash 7.13.1 Release Notes
- Logstash 7.13.0 Release Notes
- Logstash 7.12.1 Release Notes
- Logstash 7.12.0 Release Notes
- Logstash 7.11.2 Release Notes
- Logstash 7.11.1 Release Notes
- Logstash 7.11.0 Release Notes
- Logstash 7.10.2 Release Notes
- Logstash 7.10.1 Release Notes
- Logstash 7.10.0 Release Notes
- Logstash 7.9.3 Release Notes
- Logstash 7.9.2 Release Notes
- Logstash 7.9.1 Release Notes
- Logstash 7.9.0 Release Notes
- Logstash 7.8.1 Release Notes
- Logstash 7.8.0 Release Notes
- Logstash 7.7.1 Release Notes
- Logstash 7.7.0 Release Notes
- Logstash 7.6.2 Release Notes
- Logstash 7.6.1 Release Notes
- Logstash 7.6.0 Release Notes
- Logstash 7.5.2 Release Notes
- Logstash 7.5.1 Release Notes
- Logstash 7.5.0 Release Notes
- Logstash 7.4.2 Release Notes
- Logstash 7.4.1 Release Notes
- Logstash 7.4.0 Release Notes
- Logstash 7.3.2 Release Notes
- Logstash 7.3.1 Release Notes
- Logstash 7.3.0 Release Notes
- Logstash 7.2.1 Release Notes
- Logstash 7.2.0 Release Notes
- Logstash 7.1.1 Release Notes
- Logstash 7.1.0 Release Notes
- Logstash 7.0.1 Release Notes
- Logstash 7.0.0 Release Notes
- Logstash 7.0.0-rc2 Release Notes
- Logstash 7.0.0-rc1 Release Notes
- Logstash 7.0.0-beta1 Release Notes
- Logstash 7.0.0-alpha2 Release Notes
- Logstash 7.0.0-alpha1 Release Notes
Running Logstash as a Service on Debian or RPM
editRunning Logstash as a Service on Debian or RPM
editLogstash is not started automatically after installation. How to start and stop Logstash depends on whether your system uses systemd, upstart, or SysV.
Here are some common operating systems and versions, and the corresponding startup styles they use. This list is intended to be informative, not exhaustive.
Distribution |
Service System |
|
Ubuntu 16.04 and newer |
||
Ubuntu 12.04 through 15.10 |
||
Debian 8 "jessie" and newer |
||
Debian 7 "wheezy" and older |
||
CentOS (and RHEL) 7 and newer |
||
CentOS (and RHEL) 6 |
Running Logstash by Using Systemd
editDistributions like Debian Jessie, Ubuntu 15.10+, and many of the SUSE derivatives use systemd and the
systemctl
command to start and stop services. Logstash places the systemd unit files in /etc/systemd/system
for both deb and rpm. After installing the package, you can start up Logstash with:
sudo systemctl start logstash.service
Running Logstash by Using Upstart
editFor systems that use upstart, you can start Logstash with:
sudo initctl start logstash
The auto-generated configuration file for upstart systems is /etc/init/logstash.conf
.
Running Logstash by Using SysV
editFor systems that use SysV, you can start Logstash with:
sudo /etc/init.d/logstash start
The auto-generated configuration file for SysV systems is /etc/init.d/logstash
.
On this page