Logstash Shipper

etc-init-logstash

# logstash - shipper instance

description     "logstash shipper instance"

pre-start script
    mkdir -p /mnt/logs
end script

start on [2345]
stop on runlevel [06]

respawn
respawn limit 10 30

# set HOME to point to where you want the embedded elasticsearch
# data directory to be created and ensure /opt/logstash is owned
# by logstash:adm

#env HOME=/usr/local/bin/logstash

#env JAVA_OPTS='-Xms512m -Xmx512m'

script
  exec sudo java -jar /usr/local/bin/logstash/logstash.jar agent -f /etc/logstash.conf --log /mnt/logs/logstash.log 
end script

etc-init.d-logstash

#! /bin/sh
### BEGIN INIT INFO
# Provides: logstash
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: S 0 1 6
# Short-Description: Logstash
# Description: Starts Logstash as a daemon.
# Author: christian.paredes@sbri.org
### END INIT INFO

# Amount of memory for Java
# not using this
JAVAMEM=256M

# User to run logstash server as
LOGSTASH_USER=root
LOGSTASH_GROUP=root

# Location of logstash files
LOCATION=/usr/local/bin/logstash

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin/logstash
DESC="Logstash Daemon"
NAME=java
DAEMON=`which java`
CONFIGFILE="/etc/logstash.conf"
LOGFILE="/mnt/logs/logstash.log"

# not using this
PATTERNSPATH="/opt/logstash/patterns"

# original ARGS
# ARGS="-Xmx$JAVAMEM -Xms$JAVAMEM -jar logstash-monolithic.jar agent --config ${CONFIGFILE} --log ${LOGFILE} --grok-patterns-path ${PATTERNSPATH}"

ARGS=" -jar logstash.jar agent --config ${CONFIGFILE} --log ${LOGFILE} "

SCRIPTNAME=/etc/init.d/logstash
PID="/var/run/logstash-shipper.pid"

# Exit if the package is not installed
if [ ! -x "$DAEMON" ]; then
{
  echo "Couldn't find $DAEMON"
  exit 99
}
fi

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{
  start-stop-daemon --start --make-pidfile --pidfile $PID --quiet --background --chuid $LOGSTASH_USER:$LOGSTASH_GROUP -d $LOCATION --exec $DAEMON -- $ARGS \
  || return 2
}

#
# Function that stops the daemon/service
#
do_stop()
{
  # Return
  # 0 if daemon has been stopped
  # 1 if daemon was already stopped
  # 2 if daemon could not be stopped
  # other if a failure occurred
  start-stop-daemon --stop --pidfile $PID --quiet --oknodo
  RETVAL="$?"
  rm -f $PID
  return "$RETVAL"
}

case "$1" in
  start)
    log_daemon_msg "Starting $DESC"
    do_start
    case "$?" in
      0|1) log_end_msg 0 ;;
      2) log_end_msg 1 ;;
    esac
    ;;
  stop)
    log_daemon_msg "Stopping $DESC"
    do_stop
    case "$?" in
      0|1) log_end_msg 0 ;;
      2) log_end_msg 1 ;;
    esac
    ;;
  restart)
    log_daemon_msg "Restarting $DESC"
    do_stop
    case "$?" in
      0|1)
        do_start
        case "$?" in
          0) log_end_msg 0 ;;
          1) log_end_msg 1 ;; # Old process is still running
          *) log_end_msg 1 ;; # Failed to start
        esac
        ;;
      *)
        # Failed to stop
        log_end_msg 1
        ;;
    esac
    ;;
  *)
    echo "Usage: $SCRIPTNAME {start|stop|restart}" >&2
    exit 3
    ;;
esac

exit 0

etc-logstash.conf

input {
  file { 
    type => "onpage"
    path => [ "/mnt/logs/onpage.log" ]
    format => [ "json" ]
  } 
} 
output { 
  redis {
    key => "logstash-onpage"
    data_type => "list" 
    type => "onpage"
    host => "10.86.151.202" # "ag"
  }
}

logstash-shipper.markdown

Setup New Logstash Shipper

• Install jdk
• Install logstash

sudo mkdir -p /usr/local/bin/logstash
cd /usr/local/bin/logstash
sudo wget https://logstash.objects.dreamhost.com/release/logstash-1.1.5-monolithic.jar
ln -s ./logstash-1.1.5-monolithic.jar ./logstash.jar

• install /etc/logstash.conf (in this gist)
• install /etc/init.d/logstash (in this gist)

make sure the logstash service tries to restart last. to be sure java has restarted already.

update-rc.d logstash defaults 99

start service

sudo /etc/init.d/logstash start

• prep logstash log

sudo chmod 777 /mnt/logs/logstash.log

Application

Be sure the log being written by the application matches the input file path in /etc/logstash.conf

the permissions of the application log should also be chmod 777

Monitoring

tail -f /mnt/logs/logstash.log