logstash is not running on centos 7 about elk-docker HOT 4 CLOSED

touch: cannot touch '/data/log/logstash/logstash.log': No such file or directory
chown: cannot access '/data/log/logstash/logstash.log': No such file or directory
[root@log /]# /usr/local/bin/logstash: line 57: /data/log/logstash/logstash.stdout: No such file or directory

As you changed the LS_LOG_DIR environment variable to /data/log/logstash, in your Dockerfile you need to create the /data/log/logstash directory and make it writable by the logstash user (which the Logstash service should run as). You want something like:

mkdir -p /data/log/logstash
chown logstash:logstash /data/log/logstash

[root@log /]# /usr/local/bin/logstash start

I'd recommend using:

• either the service logstash start (with the original logstash-init file copied to /etc/init.d/logstash as in the initial Dockerfile) to make sure that the environment is set up correctly and that the proper arguments are passed to logstash (and that Logstash is started as logstash rather than root);
• or – if you don't want to use an init file and want to start Logstash manually instead – something more along the lines of logstash agent -f ${LS_CONF_DIR} -l ${LS_LOG_FILE} ${LS_OPTS} > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" & (as in the init file, making sure that you've also populated JAVA_OPTS and the rest of the environment variables).

Let me know if that works out for you.

Oh, and from the output:

logstash started.

Seems that Logstash did start and may actually be running 😃 (despite not being able to write out its logs or its stdout/stderr due to the missing directory).

from elk-docker.

@spujadas
Thanks for the comprehensive instructions. Much appreciated.

It works like a charm!

[root@log /]# /etc/init.d/logstash status
logstash is running

from elk-docker.

Client logs forwarded to the elk host, is stored on the elk?
If so, you need to make a mount volumes to the host,What do you think?

from elk-docker.

Glad to hear that you got it working!

As for maintaining the logs across restarts, you might want to take a look at Making log data persistent, which explains how to create a Docker data volume in the ELK container.

Other options include:

• bind mounting the /var/lib/elasticsearch directory in the container to a directory on the host (e.g. docker run ... -v /some/dir/on/host:/var/lib/elasticsearch ...);
• adding a VOLUME /var/lib/elasticsearch instruction in the Dockerfile. I'll probably do that in the very near future to make the log data persistent by default in the image.

Hope that helps.

from elk-docker.