安裝的是最新7.X系列首先要寫repo文件
/etc/yum.repos.d/elasticsearch.repo [elasticsearch-7.x] name=Elasticsearch repository for 7.x packages baseurl=https://artifacts.elastic.co/packages/7.x/yum gpgcheck=0 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md
關閉了 gpgcheck ，測試不需要檢查。
然后直接安裝
yum -y install logstash
安裝很慢需要耐心等，當然也可以從官方網站下載，我這里是yum安裝
手動添加systemd服務
/usr/share/logstash/bin/system-install
完成后會創建腳本/etc/systemd/system/logstash.service
[Unit] Description=logstash [Service] Type=simple User=logstash Group=logstash # Load env vars from /etc/default/ and /etc/sysconfig/ if they exist. # Prefixing the path with '-' makes it try to load, but if the file doesn't # exist, it continues onward. EnvironmentFile=-/etc/default/logstash EnvironmentFile=-/etc/sysconfig/logstash ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" Restart=always WorkingDirectory=/ Nice=19 LimitNOFILE=16384 [Install] WantedBy=multi-user.target
啟動
systemctl start logstash
檢查
systemctl status logstash
發現錯誤，無法啟動，查看系統日志tail -999f /var/log/messages
Sep 25 09:52:57 xh_nginx systemd: Started logstash. Sep 25 09:52:57 xh_nginx systemd: Starting logstash... Sep 25 09:52:57 xh_nginx logstash: could not find java; set JAVA_HOME or ensure java is in PATH Sep 25 09:52:57 xh_nginx systemd: logstash.service: main process exited, code=exited, status=1/FAILURE Sep 25 09:52:57 xh_nginx systemd: Unit logstash.service entered failed state. Sep 25 09:52:57 xh_nginx systemd: logstash.service failed. Sep 25 09:52:57 xh_nginx systemd: logstash.service holdoff time over, scheduling restart. Sep 25 09:52:57 xh_nginx systemd: Cannot add dependency job for unit rpcbind.socket, ignoring: Unit not found.
報的錯是無法找到java，原因是java 是手動tar安裝的，而logstash默認配置文件去 /usr/bin、/bin、/sbin、/usr/sbin 找，所以無法找到，解決辦法很多，我這里軟連接解決的。
which java
ln -s /usr/src/java/bin/* /bin
或者在logstash 配置文件添加環境變量
/usr/share/logstash/bin/logstash.lib.sh
JAVA_HOME="/usr/src/java"
這樣一來他就會找到java環境了。
[root@xh_nginx sysconfig]# systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2019-09-25 10:06:54 CST; 9s ago Main PID: 15468 (java) Tasks: 17 Memory: 522.7M CGroup: /system.slice/logstash.service └─15468 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSIniti...