一次logstash 启动，linux分析解决问题

1.官网上下载logstash 6.5.4.npm包之后，添加到yum仓库；

2.使用yum install logstash 安装npm包，包安装成功，查看systemctl status logstash 任务启动失败

[root@worker1 ~]# service logstash status
Redirecting to /bin/systemctl status  logstash.service
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Thu 2019-01-17 11:03:03 CST; 1 day 23h ago
  Process: 5848 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=exited, status=1/FAILURE)
 Main PID: 5848 (code=exited, status=1/FAILURE)

Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state.
Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed.
Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart.
Jan 17 11:03:03 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service
Jan 17 11:03:03 worker1.n1 systemd[1]: Failed to start logstash.
Jan 17 11:03:03 worker1.n1 systemd[1]: Unit logstash.service entered failed state.
Jan 17 11:03:03 worker1.n1 systemd[1]: logstash.service failed.

3. 单独启动logstash，/usr/share/logstash/bin/logstash --path.settings /etc/logstash ，logstash可以正常启动，所以判断为启动项的问题，

查看systemctl的启动项，/etc/systemd/system/logstash.service

 

[root@worker1 ~]# vi /etc/systemd/system/logstash.service

[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target

以为是权限问题，更改user，group为root， 执行 systemctl daemon-reload 让配置生效

重新启动logstash， 

systemctl start logstash 查看 systemctl status logstash，

依旧不能以服务的方式启动

4.使用journalctl -ex 查看，发现没有指定JAVA_HOME,

Jan 19 10:17:15 worker1.n1 logstash[28297]: could not find java; set JAVA_HOME or ensure java is in PATH
Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
Jan 19 10:17:15 worker1.n1 systemd[1]: Unit logstash.service entered failed state.
Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service failed.
Jan 19 10:17:15 worker1.n1 systemd[1]: logstash.service holdoff time over, scheduling restart.
Jan 19 10:17:15 worker1.n1 systemd[1]: start request repeated too quickly for logstash.service
Jan 19 10:17:15 worker1.n1 systemd[1]: Failed to start logstash.
-- Subject: Unit logstash.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit logstash.service has failed

echo $JAVA_HOME, 查看本地env都有配置，可能是logstash启动的时候没有读取到系统的JAVA_HOME环境；

5.在logstash 以server启动的时候加入启动项JAVA_HOME

vi /etc/sysconfig/logstash

增加JAVA_HOME路径

6.改回vi /etc/sysconfig/logstash的权限为初始的logstash，重启logstash，服务可以正常启动了

● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
   Active: active (running) since Sat 2019-01-19 10:21:24 CST; 4s ago
 Main PID: 26014 (java)
   CGroup: /system.slice/logstash.service
           └─26014 /usr/local/jdk/latest/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compi...