Managing the Logstash service with systemctl controls when pipelines run, when configuration changes take effect, and whether ingestion returns after maintenance. On package-based Linux hosts, logstash.service is the service boundary for starting, stopping, restarting, enabling, disabling, and checking the packaged Logstash process.
DEB and RPM packages install a systemd unit named logstash.service and run it as the logstash user. The package layout separates service settings, runtime data, and internal logs, so service checks should follow the packaged unit instead of a one-off foreground command.
A running unit means the JVM and configured pipelines have started under systemd, but it does not prove every input, filter, output, credential, or downstream endpoint is working. Test the packaged configuration before a restart, then pair the service state with the journal and the local monitoring API so a failed pipeline does not look like a successful maintenance window.
Steps to manage the Logstash service with systemctl in Linux:
- Check the current Logstash service state.
$ sudo systemctl status logstash.service --no-pager ● logstash.service - logstash Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: enabled) Active: active (running) since Thu 2026-06-18 20:57:10 UTC; 16s ago Main PID: 307 (java) Tasks: 66 (limit: 28490) Memory: 665.7M CPU: 26.887s ##### snipped #####The Loaded line shows the unit file path, local boot-start state, and vendor preset. disabled; preset: enabled still means the host will not start Logstash on the next boot until the unit is enabled.
- Test the packaged Logstash configuration before a restart.
$ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-configtest --config.test_and_exit Using bundled JDK: /usr/share/logstash/jdk Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties ##### snipped ##### Configuration OK [2026-06-18T20:57:05,875][INFO ][logstash.runner ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash
The temporary --path.data directory must be writable by the logstash user and keeps the validation run away from /var/lib/logstash. Current Logstash releases default allow_superuser to false, so run package-based validation as the service account unless that setting was intentionally changed.
- Start the Logstash service.
$ sudo systemctl start logstash.service
No output means systemd accepted the start request. A pipeline error can still move the unit to failed, so check the active state next.
- Confirm that Logstash is active.
$ systemctl is-active logstash.service active
- Enable Logstash to start automatically at boot.
$ sudo systemctl enable logstash.service Created symlink '/etc/systemd/system/multi-user.target.wants/logstash.service' -> '/usr/lib/systemd/system/logstash.service'.
Use sudo systemctl enable --now logstash.service when the service should be enabled and started in one action.
- Confirm the boot-start state.
$ systemctl is-enabled logstash.service enabled
- Reload the systemd manager after changing a Logstash unit override.
$ sudo systemctl daemon-reload
Run this after editing files under /etc/systemd/system/logstash.service.d/, then restart logstash.service so the new unit settings apply.
- Restart Logstash after pipeline, settings, JVM, plugin, or unit changes that require a process restart.
$ sudo systemctl restart logstash.service
Restarting Logstash pauses active pipelines while inputs close, filters recompile, queues reconnect, and outputs reopen.
- Confirm that the local monitoring API responds after the restart.
$ curl --silent --show-error 'http://localhost:9600/?pretty=true' { "host" : "logstash-01", "version" : "9.4.2", "http_address" : "127.0.0.1:9600", "status" : "green", "pipeline" : { "workers" : 10, "batch_size" : 125, "batch_delay" : 50 } }Package defaults enable the monitoring API on the local interface. Use the configured api.http.host, api.http.port, TLS setting, and credentials when the API has been secured or moved.
Related: How to check Logstash pipeline metrics - Review recent Logstash service messages in the journal.
$ sudo journalctl --unit=logstash.service --since "5 minutes ago" --no-pager Jun 18 20:57:10 logstash-01 systemd[1]: Started logstash.service - logstash. Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,400][INFO ][logstash.agent ] Successfully started Logstash API endpoint {port: 9600, ssl_enabled: false} Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,984][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id" => "main"} Jun 18 20:57:17 logstash-01 logstash[307]: [2026-06-18T20:57:17,997][INFO ][logstash.agent ] Pipelines running {count: 1, running_pipelines: [:main], non_running_pipelines: []}Packaged installs also write Logstash internal logs under /var/log/logstash. Inspect that directory when journal output points to pipeline compilation, JVM, plugin, or startup failures.
Related: How to debug Logstash pipelines - Stop Logstash when pipelines must stop processing events.
$ sudo systemctl stop logstash.service
Stopping Logstash halts active inputs and outputs until the service starts again. Upstream shippers may buffer, retry, or drop events if they cannot queue locally.
- Confirm that Logstash is inactive after a planned stop.
$ systemctl is-active logstash.service inactive
- Disable automatic startup when Logstash should remain stopped after reboot.
$ sudo systemctl disable logstash.service Removed '/etc/systemd/system/multi-user.target.wants/logstash.service'.
Disabling changes only the next-boot behavior. Use sudo systemctl disable --now logstash.service when the service should be disabled and stopped in one action.
- Remove the temporary validation data directory.
$ sudo rm --recursive --force /tmp/logstash-configtest
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
