1.官網上下載logstash 6.5.4.npm包之后，添加到yum倉庫；
2.使用yum install logstash 安裝npm包，包安裝成功，查看systemctl status logstash 任務啟動失敗
[root@worker1 ~]# service logstash status Redirecting to /bin/systemctl status logstash.service ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled) Active: failed (Result: start-limit) since Thu 2019-01-17 11:03:03 CST; 1 day 23h ago Process: 5848 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE) Main PID: 5848 (code=exited, status=1/FAILURE) Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart. Jan 17 11:03:03 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service Jan 17 11:03:03 worker1.n1 systemd[1]: Failed to start logstash. Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed.
3. 單獨啟動logstash，/usr/share/logstash/bin/logstash --path.settings /etc/logstash ，logstash可以正常啟動，所以判斷為啟動項的問題，
查看systemctl的啟動項，/etc/systemd/system/logstash.service
[root@worker1 ~]# vi /etc/systemd/system/logstash.service [Unit] Description=logstash [Service] Type=simple User=logstash Group=logstash # Load env vars from /etc/default/ and /etc/sysconfig/ if they exist. # Prefixing the path with '-' makes it try to load, but if the file doesn't # exist, it continues onward. EnvironmentFile=-/etc/default/logstash EnvironmentFile=-/etc/sysconfig/logstash ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" Restart=always WorkingDirectory=/ Nice=19 LimitNOFILE=16384 [Install] WantedBy=multi-user.target
以為是權限問題，更改user，group為root， 執行 systemctl daemon-reload 讓配置生效
重新啟動logstash，
systemctl start logstash 查看 systemctl status logstash，
依舊不能以服務的方式啟動
4.使用journalctl -ex 查看，發現沒有指定JAVA_HOME,
Jan 19 10:17:15 worker1.n1 logstash[28297]: could not find java; set JAVA_HOME or ensure java is in PATH Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE Jan 19 10:17:15 worker1.n1 systemd[1]: Unit logstash.service entered failed state. Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service failed. Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart. Jan 19 10:17:15 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service Jan 19 10:17:15 worker1.n1 systemd[1]: Failed to start logstash. -- Subject: Unit logstash.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit logstash.service has failed
echo $JAVA_HOME, 查看本地env都有配置，可能是logstash啟動的時候沒有讀取到系統的JAVA_HOME環境；
5.在logstash 以server啟動的時候加入啟動項JAVA_HOME
vi /etc/sysconfig/logstash
增加JAVA_HOME路徑
6.改回vi /etc/sysconfig/logstash的權限為初始的logstash，重啟logstash，服務可以正常啟動了
● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled) Active: active (running) since Sat 2019-01-19 10:21:24 CST; 4s ago Main PID: 26014 (java) CGroup: /system.slice/logstash.service └─26014 /usr/local/jdk/latest/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compi...