Logstash configtest - logstash

Question

I ran service logstash configtest but error given was:
logstash: unrecognized service
I was able to run logstash service individually but not with "configtest". In etc/logstash/conf.d/ I created logstash.conf file where consist of code as present below:-
Additional info:-
service logstash status
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; disabled)
Active: active (running) since Mon 2016-12-26 12:40:58 PST; 6s ago
Main PID: 3512 (java)
CGroup: /system.slice/logstash.service
└─3512 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX...
Dec 26 12:40:58 Mr systemd[1]: Started logstash.
Service while running with configtest:-
root#Mr:/# service logstash configtest
logstash: unrecognized service
I am running this on debian8 machine, hope i will get a good solution from you guys.
# This input block will listen on port 10514 for logs to come in.
# host should be an IP on the Logstash server.
# codec => "json" indicates that we expect the lines we're receiving to be in JSON format
# type => "rsyslog" is an optional identifier to help identify messaging streams in the pipeline.
input {
udp {
host => "logstash_private_ip"
port => 10514
codec => "json"
type => "rsyslog"
}
}
# This is an empty filter block. You can later add other filters here to further process
# your log lines
filter { }
# This output block will send all events of type "rsyslog" to Elasticsearch at the configured
# host and port into daily indices of the pattern, "rsyslog-YYYY.MM.DD"
output {
if [type] == "rsyslog" {
elasticsearch {
hosts => [ "elasticsearch_private_ip:9200" ]
}
}
}

Answer 1

for old logstash
/opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/
Later, it became installed in /usr/share/logstash so try either
/usr/share/logstash/bin/logstash --configtest -f <the config file/folder>
Or if running version 5.1+ use --config.test_and_exit
/usr/share/logstash/bin/logstash --config.test_and_exit -f <the config file/folder>

Answer 2

I had the same problem and it helped me a lot:
If you are running Logstash version 5, the following command to test the configuration will give you an error:
sudo /opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/
The right command to test it is:
sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
I'm running ELK + filebeat since an Ubuntu Server 16.04 and my result was:
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK
Sources:
https://www.elastic.co/guide/en/logstash/current/running-logstash.html; https://github.com/elastic/logstash/issues/6161

Answer 3

for logstash 5.1 its
/usr/share/logstash/bin/logstash --config.test_and_exit -f logstash.yml

Answer 4

Using the official logstash Docker image to validate a local file:
docker run -it -v /etc/logstash:/etc/logstash logstash /usr/share/logstash/bin/logstash -t -f /etc/logstash/logstash.conf
This assumes your config file is locally in /etc/logstash, then mounts that folder into the container, under the same path. Then the binary can find the config file inside the container.
There might be a better way to run that command, this worked for me.

Answer 5

If you want to test your configs with a docker container logstash 6.x
docker run -it -v $PWD:/etc/logstash/conf.d --entrypoint "bin/logstash" logstash "--config.test_and_exit"

Answer 6

You should do this on CentOS version 7:
/etc/rc.d/init.d/logstash configtest /etc/logstash/conf.d/test.conf

Answer 7

On Centos 7, you can also use the following command:
/usr/share/logstash/bin/logstash --path.settings /etc/logstash/
--config.test_and_exit /etc/logstash/conf.d/logstash.conf