How to install Logstash on CentOS, RHEL, or Fedora

Installing Logstash on CentOS, RHEL, or Fedora through Elastic's RPM repository adds the packaged event-processing runtime used to receive, transform, and forward logs before they reach Elasticsearch or another destination.

Elastic publishes Yum repository paths by major release line, so current 9.x installs use the /packages/9.x/yum repository instead of a floating latest URL. The RPM package installs the application under /usr/share/logstash, keeps settings in /etc/logstash, creates the logstash.service unit, and includes a bundled JDK under /usr/share/logstash/jdk.

The package install does not create a working ingest pipeline or start the service automatically. Verify the package, binary, and service unit first, then configure at least one pipeline before starting Logstash as a long-running systemd service.

Steps to install Logstash on CentOS, RHEL, or Fedora:

Import the Elastic signing key for RPM packages.
```
$ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
```
The key import is a host-level trust step for Elastic RPM repositories and is normally needed only once.
Create the Elastic Yum repository file for the current Logstash 9.x package line.
```
[logstash-9.x]
name=Elastic repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
```
Elastic splits package repositories by major version to avoid accidental major-version upgrades. Use the matching repository line when a host must stay on an earlier Elastic Stack series.
Confirm that dnf can see the Logstash package from the Elastic repository.
```
$ sudo dnf --disablerepo="*" --enablerepo="logstash-9.x" list logstash
Available Packages
logstash.x86_64                     1:9.4.2-1                     logstash-9.x
```
The architecture and exact package version change with the host and the current Elastic release. Older hosts without dnf can use yum with the same repository file.

Install the Logstash package.

$ sudo dnf install --assumeyes logstash
##### snipped #####
Installed:
  logstash-1:9.4.2-1.x86_64

Complete!

Confirm the installed Logstash binary and bundled JDK.

$ /usr/share/logstash/bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 9.4.2

Check the packaged directories created by the RPM.

$ ls -ld /usr/share/logstash /etc/logstash /etc/logstash/conf.d /var/lib/logstash /var/log/logstash
drwxr-xr-x  3 root     root     4096 Jun 18 20:23 /etc/logstash
drwxr-xr-x  2 root     root     4096 May 23 16:13 /etc/logstash/conf.d
drwxr-xr-x 10 root     root     4096 Jun 18 20:22 /usr/share/logstash
drwxr-xr-x  2 logstash logstash 4096 May 23 16:13 /var/lib/logstash
drwxr-xr-x  2 logstash root     4096 Jun 18 20:23 /var/log/logstash

Verify that the systemd unit was installed.

$ systemctl cat logstash.service
# /usr/lib/systemd/system/logstash.service
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
##### snipped #####

[Install]
WantedBy=multi-user.target

Test the installed runtime with a temporary one-event pipeline.

$ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-install-check --config.test_and_exit -e 'input { generator { count => 1 } } output { stdout { codec => rubydebug } }'
Using bundled JDK: /usr/share/logstash/jdk
##### snipped #####
Configuration OK
[2026-06-18T20:30:55,724][INFO ][logstash.runner          ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

The temporary --path.data directory keeps the validation away from the packaged service data directory in /var/lib/logstash.

Remove the temporary validation data directory.
```
$ sudo rm -rf /tmp/logstash-install-check
```
Configure a real pipeline before starting the Logstash service.

Related: How to configure Logstash pipelines
Related: How to manage the Logstash service with systemctl in Linux