How to install Logstash on Ubuntu or Debian

Installing Logstash on Ubuntu or Debian adds a package-managed event processing service for collecting, transforming, and routing logs before they reach Elasticsearch, queues, files, or other destinations. The supported APT repository keeps the service unit, bundled JDK, directories, and future package updates aligned with the rest of the Elastic Stack.

Elastic publishes package repositories by major version, so the repository entry should target the intended stack line such as 9.x instead of a one-off release number. The current DEB package installs the application, registers a systemd service, and keeps settings, pipeline files, runtime data, and logs in the standard package layout.

The package registers logstash.service but does not create a production pipeline for incoming events. Start the service after installation to confirm the packaged runtime works, then configure a pipeline before sending real log traffic. Older Ubuntu or Debian releases outside Elastic's support matrix may need an earlier Elastic Stack repository or a different install method.

Steps to install Logstash on Ubuntu or Debian:

Refresh the package index on the target host.
```
$ sudo apt-get update
```
Install the helper packages needed for Elastic's signed APT repository.
```
$ sudo apt-get install --assume-yes wget gpg ca-certificates apt-transport-https
```
apt-transport-https is already covered by current Ubuntu APT packages, but Elastic still lists it for Debian systems where HTTPS transport might not be present.

Import the Elastic package signing key into a dedicated APT keyring.

$ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor --yes -o /usr/share/keyrings/elastic-keyring.gpg

No output indicates the keyring file was written successfully.

Save the official Elastic 9.x repository definition.

$ echo "deb [signed-by=/usr/share/keyrings/elastic-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-9.x.list
deb [signed-by=/usr/share/keyrings/elastic-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main

Do not use add-apt-repository for this repository. Elastic does not publish source packages, so an added deb-src entry can break apt-get update with a missing main/source/Sources error.

Refresh the package index after adding the Elastic repository.

$ sudo apt-get update
Get:1 https://artifacts.elastic.co/packages/9.x/apt stable InRelease [3249 B]
Get:2 https://artifacts.elastic.co/packages/9.x/apt stable/main arm64 Packages [54.9 kB]
##### snipped #####
Reading package lists... Done

The package architecture in the output reflects the host, such as amd64 or arm64.

Confirm APT can see the Logstash package from the 9.x repository.

$ apt-cache policy logstash
logstash:
  Installed: (none)
  Candidate: 1:9.4.2-1
  Version table:
     1:9.4.2-1 500
        500 https://artifacts.elastic.co/packages/9.x/apt stable/main arm64 Packages
##### snipped #####

The candidate version changes as Elastic publishes new 9.x releases, but the repository path stays 9.x until the next major stack line.

Install the Logstash package.

$ sudo apt-get install --assume-yes logstash
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  logstash
##### snipped #####
Setting up logstash (1:9.4.2-1) ...

The package creates /etc/logstash, /usr/share/logstash, /var/lib/logstash, /var/log/logstash, and the packaged systemd unit.

Confirm the installed Logstash version.
```
$ /usr/share/logstash/bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 9.4.2
```
The bundled JDK is part of the current DEB package, so a separate Java package is not normally required.

Enable Logstash at boot and start it now.

$ sudo systemctl enable --now logstash.service
Created symlink /etc/systemd/system/multi-user.target.wants/logstash.service -> /lib/systemd/system/logstash.service.

Package installation does not start Logstash automatically.

Verify that Logstash is running under systemd.
```
$ sudo systemctl status logstash.service --no-pager --lines=0
● logstash.service - logstash
     Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-06-18 20:36:44 UTC; 9s ago
   Main PID: 24518 (java)
##### snipped #####
```
Some Debian-family hosts show the packaged unit path as /lib/systemd/system/logstash.service instead of /usr/lib/systemd/system/logstash.service because both locations can map to the same merged-usr unit file.

Related: How to manage the Logstash service with systemctl in Linux
Confirm the local monitoring API responds.
```
$ curl -s 'http://127.0.0.1:9600/?pretty'
{
  "host" : "logstash-01",
  "version" : "9.4.2",
  "http_address" : "127.0.0.1:9600"
}
```
The API is enabled by default and usually binds to 127.0.0.1 on the first available port in the 9600-9700 range.

The monitoring API is not secured by default. Expose it only behind explicit network controls or configure TLS and authentication in /etc/logstash/logstash.yml.

Related: How to configure Logstash pipelines