adduser

adduser --home-dir /var/lib/logstash --no-create-home --shell /sbin/nologin logstash
mkdir -p /var/lib/logstash /var/log/logstash
chown -R logstash:logstash /var/lib/logstash /var/log/logstash

etc init.d logstash

#!/bin/bash

PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin

DESC="Logstash Daemon"

LOGSTASH_USER=logstash
DAEMON=/usr/bin/java

CONFIG_DIR="/etc/logstash"
CONFIGFILE="${CONFIG_DIR}/*.conf"
LOGDIR="/var/log/logstash"
PATTERNSPATH="/etc/logstash/patterns"

SCRIPTNAME=/etc/init.d/logstash
PIDFILE="/var/run/logstash.pid"
LOCKFILE="/var/lock/subsys/logstash"
WORKDIR=/opt/logstash

FILTER_WORKERS=1
EVENT_TIMEOUT=60
SHUTDOWN_TIMEOUT=5

[ -e /etc/sysconfig/logstash ] && . /etc/sysconfig/logstash

LOGSTASH_OPTS="--config ${CONFIGFILE} --grok-patterns-path ${PATTERNSPATH} --log ${LOGDIR}/agent.log --filterworkers ${FILTER_WORKERS} --watchdog-timeout ${EVENT_TIMEOUT}"
CMD="${DAEMON} ${JVM_OPTS} -cp /opt/logstash logstash.runner agent ${LOGSTASH_OPTS}"

. /lib/lsb/init-functions

start() {
        daemonize -c $WORKDIR -u $LOGSTASH_USER -p $PIDFILE -l $LOCKFILE -o $LOGDIR/stdout -e $LOGDIR/stderr $CMD
        if [ $? -eq 0 ]; then
                log_success_msg "Starting $DESC:"
        else
                log_failure_msg "Starting $DESC:"
        fi                                                                                                                                                                                                         
}                                                                                                                                                                                                                  
stop(){                                                                                                                                                                                                            
        [ -e "$PIDFILE" ] && [ ! -z "$(cat $PIDFILE)" ] && test -d "/proc/$(cat $PIDFILE)" && kill -SIGINT $(cat $PIDFILE)                                                                                         
        flock --exclusive --timeout $SHUTDOWN_TIMEOUT $LOCKFILE --command "echo -n"                                                                                                                                
        if [ $? -eq 0 ]; then                                                                                                                                                                                      
                log_success_msg "Stopping $DESC:"                                                                                                                                                                  
        else                                                                                                                                                                                                       
                log_failure_msg "Stopping $DESC:"                                                                                                                                                                  
        fi                                                                                                                                                                                                         
}                                                                                                                                                                                                                  
                                                                                                                                                                                                                   
case "$1" in                                                                                                                                                                                                       
        start)
                start
                ;;
        stop)
                stop
                ;;

        restart)
                stop
                sleep 0.2
                start
                ;;
        *)
                echo "Usage: $SCRIPTNAME {start|stop|restart}" >&2
                exit 1
                ;;
esac

exit 0

etc sysconfig logstash

JVM_OPTS="-Xms256M -Xmx256M"
JVM_OPTS="${JVM_OPTS} -Djava.net.preferIPv4Stack=true"