How to install Logstash on CentOS, RHEL, or Fedora

Installing Logstash on CentOS, RHEL, or Fedora provides a dependable pipeline engine for ingesting, transforming, and routing log events into Elasticsearch or other destinations. A managed systemd service keeps pipelines running across reboots and makes operational health checks consistent.

The RPM package installs Logstash under /usr/share/logstash, places configuration under /etc/logstash (including pipeline files in /etc/logstash/conf.d), and registers a logstash.service unit. A lightweight monitoring HTTP API is exposed on port 9600 to report runtime state and version information.

Elastic splits package repositories by major version, so the repository URL should match the intended major series (for example, 9.x). Installing the package does not define inputs or outputs, so no data is shipped until at least one pipeline configuration exists, and memory usage can be significant on busy systems.

1. Download and import the Elastic signing key for RPM packages.

   $ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

   The key import is typically a one-time action per host for Elastic RPM repositories.

2. Create the Logstash repository file at /etc/yum.repos.d/logstash.repo.

   [logstash-9.x]
   name=Elastic repository for 9.x packages
   baseurl=https://artifacts.elastic.co/packages/9.x/yum
   gpgcheck=1
   gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
   enabled=1
   autorefresh=1
   type=rpm-md

   Use yum instead of dnf on older CentOS and legacy RHEL systems.

3. Install the Logstash package.

   $ sudo dnf install --assumeyes logstash
   Installing:
     logstash-9.2.3-1.x86_64

4. Enable and start the Logstash service.

   $ sudo systemctl enable --now logstash
   Created symlink /etc/systemd/system/multi-user.target.wants/logstash.service -> /usr/lib/systemd/system/logstash.service.

   Related: How to manage the Logstash service with systemctl in Linux

5. Confirm the Logstash binary is installed and report its version.

   $ /usr/share/logstash/bin/logstash --version
   logstash 9.2.3

6. Verify the service is running.

   $ sudo systemctl status logstash --no-pager
   ● logstash.service - logstash
        Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled)
        Active: active (running)
   ##### snipped #####

   

7. Confirm the monitoring API is responding on localhost:9600.

   $ curl -s http://localhost:9600
   {
     "host" : "logstash",
     "version" : "9.2.3",
     "http_address" : "127.0.0.1:9600"
   }

   The monitoring API binds to 127.0.0.1 by default; adjust http.host and http.port in /etc/logstash/logstash.yml for remote checks.