How to install Logstash on CentOS, RHEL, or Fedora

Installing Logstash on CentOS, RHEL, or Fedora through Elastic's RPM repository adds the packaged event-processing runtime used to receive, transform, and forward logs before they reach Elasticsearch or another destination.

Elastic publishes Yum repository paths by major release line, so current 9.x installs use the /packages/9.x/yum repository instead of a floating latest URL. The RPM package installs the application under /usr/share/logstash, keeps settings in /etc/logstash, creates the logstash.service unit, and includes a bundled JDK under /usr/share/logstash/jdk.

The package install does not create a working ingest pipeline or start the service automatically. Verify the package, binary, and service unit first, then configure at least one pipeline before starting Logstash as a long-running systemd service.

1. Import the Elastic signing key for RPM packages.

   $ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

   The key import is a host-level trust step for Elastic RPM repositories and is normally needed only once.

2. Create the Elastic Yum repository file for the current Logstash 9.x package line.

   [logstash-9.x]
   name=Elastic repository for 9.x packages
   baseurl=https://artifacts.elastic.co/packages/9.x/yum
   gpgcheck=1
   gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
   enabled=1
   autorefresh=1
   type=rpm-md

   Elastic splits package repositories by major version to avoid accidental major-version upgrades. Use the matching repository line when a host must stay on an earlier Elastic Stack series.

3. Confirm that dnf can see the Logstash package from the Elastic repository.

   $ sudo dnf --disablerepo="*" --enablerepo="logstash-9.x" list logstash
   Available Packages
   logstash.x86_64                     1:9.4.2-1                     logstash-9.x

   The architecture and exact package version change with the host and the current Elastic release. Older hosts without dnf can use yum with the same repository file.

4. Install the Logstash package.

   $ sudo dnf install --assumeyes logstash
   ##### snipped #####
   Installed:
     logstash-1:9.4.2-1.x86_64
   
   Complete!

5. Confirm the installed Logstash binary and bundled JDK.

   $ /usr/share/logstash/bin/logstash --version
   Using bundled JDK: /usr/share/logstash/jdk
   logstash 9.4.2

6. Check the packaged directories created by the RPM.

   $ ls -ld /usr/share/logstash /etc/logstash /etc/logstash/conf.d /var/lib/logstash /var/log/logstash
   drwxr-xr-x  3 root     root     4096 Jun 18 20:23 /etc/logstash
   drwxr-xr-x  2 root     root     4096 May 23 16:13 /etc/logstash/conf.d
   drwxr-xr-x 10 root     root     4096 Jun 18 20:22 /usr/share/logstash
   drwxr-xr-x  2 logstash logstash 4096 May 23 16:13 /var/lib/logstash
   drwxr-xr-x  2 logstash root     4096 Jun 18 20:23 /var/log/logstash

7. Verify that the systemd unit was installed.

   $ systemctl cat logstash.service
   # /usr/lib/systemd/system/logstash.service
   [Unit]
   Description=logstash
   
   [Service]
   Type=simple
   User=logstash
   Group=logstash
   ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
   Restart=always
   ##### snipped #####
   
   [Install]
   WantedBy=multi-user.target

   Related: How to manage the Logstash service with systemctl in Linux

8. Test the installed runtime with a temporary one-event pipeline.

   $ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-install-check --config.test_and_exit -e 'input { generator { count => 1 } } output { stdout { codec => rubydebug } }'
   Using bundled JDK: /usr/share/logstash/jdk
   ##### snipped #####
   Configuration OK
   [2026-06-18T20:30:55,724][INFO ][logstash.runner          ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

   The temporary --path.data directory keeps the validation away from the packaged service data directory in /var/lib/logstash.

9. Remove the temporary validation data directory.

   $ sudo rm -rf /tmp/logstash-install-check

10. Configure a real pipeline before starting the Logstash service.

    Related: How to configure Logstash pipelines
    Related: How to manage the Logstash service with systemctl in Linux