How to manage the Logstash service with systemctl in Linux

Managing the Logstash service with systemctl controls when pipelines run, when configuration changes take effect, and whether ingestion returns after maintenance. On package-based Linux hosts, logstash.service is the service boundary for starting, stopping, restarting, enabling, disabling, and checking the packaged Logstash process.

DEB and RPM packages install a systemd unit named logstash.service and run it as the logstash user. The package layout separates service settings, runtime data, and internal logs, so service checks should follow the packaged unit instead of a one-off foreground command.

A running unit means the JVM and configured pipelines have started under systemd, but it does not prove every input, filter, output, credential, or downstream endpoint is working. Test the packaged configuration before a restart, then pair the service state with the journal and the local monitoring API so a failed pipeline does not look like a successful maintenance window.

Steps to manage the Logstash service with systemctl in Linux:

Check the current Logstash service state.

$ sudo systemctl status logstash.service --no-pager
● logstash.service - logstash
     Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-06-18 20:57:10 UTC; 16s ago
   Main PID: 307 (java)
      Tasks: 66 (limit: 28490)
     Memory: 665.7M
        CPU: 26.887s
##### snipped #####

The Loaded line shows the unit file path, local boot-start state, and vendor preset. disabled; preset: enabled still means the host will not start Logstash on the next boot until the unit is enabled.

Test the packaged Logstash configuration before a restart.

$ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-configtest --config.test_and_exit
Using bundled JDK: /usr/share/logstash/jdk
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
##### snipped #####
Configuration OK
[2026-06-18T20:57:05,875][INFO ][logstash.runner          ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

The temporary --path.data directory must be writable by the logstash user and keeps the validation run away from /var/lib/logstash. Current Logstash releases default allow_superuser to false, so run package-based validation as the service account unless that setting was intentionally changed.

Start the Logstash service.
```
$ sudo systemctl start logstash.service
```
No output means systemd accepted the start request. A pipeline error can still move the unit to failed, so check the active state next.

Confirm that Logstash is active.

$ systemctl is-active logstash.service
active

Enable Logstash to start automatically at boot.

$ sudo systemctl enable logstash.service
Created symlink '/etc/systemd/system/multi-user.target.wants/logstash.service' -> '/usr/lib/systemd/system/logstash.service'.

Use sudo systemctl enable --now logstash.service when the service should be enabled and started in one action.

Confirm the boot-start state.

$ systemctl is-enabled logstash.service
enabled

Reload the systemd manager after changing a Logstash unit override.
```
$ sudo systemctl daemon-reload
```
Run this after editing files under /etc/systemd/system/logstash.service.d/, then restart logstash.service so the new unit settings apply.
Restart Logstash after pipeline, settings, JVM, plugin, or unit changes that require a process restart.
```
$ sudo systemctl restart logstash.service
```
Restarting Logstash pauses active pipelines while inputs close, filters recompile, queues reconnect, and outputs reopen.

Related: How to enable Logstash pipeline reloads
Confirm that the local monitoring API responds after the restart.
```
$ curl --silent --show-error 'http://localhost:9600/?pretty=true'
{
  "host" : "logstash-01",
  "version" : "9.4.2",
  "http_address" : "127.0.0.1:9600",
  "status" : "green",
  "pipeline" : {
    "workers" : 10,
    "batch_size" : 125,
    "batch_delay" : 50
  }
}
```
Package defaults enable the monitoring API on the local interface. Use the configured api.http.host, api.http.port, TLS setting, and credentials when the API has been secured or moved.
Related: How to check Logstash pipeline metrics

Review recent Logstash service messages in the journal.

$ sudo journalctl --unit=logstash.service --since "5 minutes ago" --no-pager
Jun 18 20:57:10 logstash-01 systemd[1]: Started logstash.service - logstash.
Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,400][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {port: 9600, ssl_enabled: false}
Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,984][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id" => "main"}
Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,997][INFO ][logstash.agent           ] Pipelines running {count: 1, running_pipelines: [:main], non_running_pipelines: []}

Packaged installs also write Logstash internal logs under /var/log/logstash. Inspect that directory when journal output points to pipeline compilation, JVM, plugin, or startup failures.
Related: How to debug Logstash pipelines

Stop Logstash when pipelines must stop processing events.
```
$ sudo systemctl stop logstash.service
```
Stopping Logstash halts active inputs and outputs until the service starts again. Upstream shippers may buffer, retry, or drop events if they cannot queue locally.
Confirm that Logstash is inactive after a planned stop.
```
$ systemctl is-active logstash.service
inactive
```
Disable automatic startup when Logstash should remain stopped after reboot.
```
$ sudo systemctl disable logstash.service
Removed '/etc/systemd/system/multi-user.target.wants/logstash.service'.
```
Disabling changes only the next-boot behavior. Use sudo systemctl disable --now logstash.service when the service should be disabled and stopped in one action.

Remove the temporary validation data directory.

$ sudo rm --recursive --force /tmp/logstash-configtest