ELK 堆栈 - logstash 未正确安装

Question

我正在尝试安装 ELK 堆栈。 Elastic Search 和 Kibana 已成功安装。它工作得很好。但是在安装 Logstash 时，它没有正确安装。当我启动logstash服务时，它显示没有logstash。我尝试搜索谷歌，但找不到合适的解决方案。我尝试重新安装软件包。不过还是没解决。

这是错误：

paulsteven@smackcoders:~$ sudo apt-get install logstash
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  logstash
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/178 MB of archives.
After this operation, 307 MB of additional disk space will be used.
Selecting previously unselected package logstash.
(Reading database ... 293176 files and directories currently installed.)
Preparing to unpack .../logstash_1%3a6.7.0-1_all.deb ...
Unpacking logstash (1:6.7.0-1) ...
Setting up logstash (1:6.7.0-1) ...
Using provided startup.options file: /etc/logstash/startup.options
Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000d4cc0000, 724828160, 0) failed; error='Not enough space' (errno=12)
/usr/share/logstash/bin/system-install: line 88: #: command not found
paulsteven@smackcoders:~$ sudo systemctl logstash status
Unknown operation logstash.

paulsteven@smackcoders:~$ sudo systemctl logstash status
Unknown operation logstash.

paulsteven@smackcoders:~$ sudo apt-get install logstash
Reading package lists... Done
Building dependency tree       
Reading state information... Done
logstash is already the newest version (1:6.7.0-1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
paulsteven@smackcoders:~$ 

Answer 1

@Smack 阿尔法

我使用 ELK 堆栈 1 个月，并使用 debian 包在我的 Ubuntu 平台上安装了这些东西。

按照步骤安装 logstash 并将其作为服务启动。

首先进入主目录

cd ~

使用wget下载logstash的debian包（注意你的logstash版本）

sudo wget https://artifacts.elastic.co/downloads/logstash/logstash-6.5.4.deb

我使用dpkg来安装logstash

sudo dpkg -i logstash-6.5.4.deb

配置 Logstash

更改 logstash.yml 的编辑权限

```sudo chmod 777 /etc/logstash/logstash.yml```

在文本编辑器中打开 logstash.yml

sudo gedit /etc/logstash/logstash.yml

更改以下行（REMOVE # TAG）

a)http.host: "0.0.0.0"（您的 IP 地址）

b)http.port: 9600-9700

保存并退出。

对任何安装疑问和错误发表评论。

Answer 2

当我试图在我的 Raspberry Pi 上安装 Logstash 时，我遇到了完全相同的错误。可能一年后它对你不再相关，但它可能对其他人有价值。

您的系统似乎没有足够的（可用）内存供 JRE 运行，正如这一行所暗示的：

Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000d4cc0000, 724828160, 0) failed; error='Not enough space' (errno=12)

下一行显示系统安装脚本中的命令失败：

/usr/share/logstash/bin/system-install: line 88: #: command not found

第 88 行如下所示：

$(ruby_exec "${LOGSTASH_HOME}/lib/systeminstall/pleasewrap.rb" "${allopts[@]}" ${program} ${LS_OPTS})

为了获得更多关于失败原因的信息，我们可以在命令之前插入一个小的 debug-echo，就像这样，只是为了查看结果：

echo "debug: $(ruby_exec "${LOGSTASH_HOME}/lib/systeminstall/pleasewrap.rb" "${allopts[@]}" ${program} ${LS_OPTS})"

现在，如果我们再次运行系统安装脚本，我们会在错误发生时获得更深入的了解：

debug: #
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 1006632960 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /usr/share/logstash/lib/systeminstall/hs_err_pid28575.log

更多信息在提到的错误日志中：

#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 1006632960 bytes for committing reserved memory.
# Possible reasons:
#   The system is out of physical RAM or swap space
#   In 32 bit mode, the process size limit was hit
# Possible solutions:
#   Reduce memory load on the system
#   Increase physical memory or swap space
#   Check if swap backing store is full
#   Use 64 bit Java on a 64 bit OS
#   Decrease Java heap size (-Xmx/-Xms)
#   Decrease number of Java threads
#   Decrease Java thread stack sizes (-Xss)
#   Set larger code cache with -XX:ReservedCodeCacheSize=
# This output file may be truncated or incomplete.
#
#  Out of Memory Error (os_linux.cpp:2757), pid=28588, tid=0xb512c460

那是我遇到的错误，对你来说可能会有所不同，但你应该能够这样调查。

因此，您可能需要检查可用内存，是否有足够的内存或任何进程消耗过多。

由于我的内存有限，我创建了一个临时交换文件作为解决方法，只是为了看看它是否可以运行，它对我有用。但这可能不是一个可行的解决方案。

Answer 3

进程是否在/etc/systemd/system/下注册？您是否在 /etc/init.d/ 中看到了 logstash 服务文件？

在某些系统上，您可能需要手动运行 /usr/share/logstash/bin 中的 system-install 脚本。