#添加用户
useradd logstash -M -s /sbin/nologin
mkdir /var/log/logstash/
chown -R logstash:logstash /var/log/logstash/
chown -R logstash:logstash /usr/local/logstash-2.0.0/





vi /etc/init.d/logstash
#!/bin/bash
#
### BEGIN INIT INFO
# Provides: logstash
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: S 0 1 6
# Short-Description: Logstash
# Description: Starts Logstash as a daemon.
# Author: christian.paredes@sbri.org
### END INIT INFO


source /etc/init.d/functions
source /lib/lsb/init-functions

# Process name
NAME=logstash
DESC="Logstash Daemon"

# Location of logstash files
LOCATION="/usr/local/logstash-2.0.0/"   #根据实际安装路径修改
CONFIG_DIR="/usr/local/logstash-2.0.0/"
LOGFILE="/var/log/logstash/logstash.log"

SCRIPTNAME=/etc/init.d/logstash
PIDFILE="/var/run/logstash-agent.pid"
LOCK_FILE=/var/lock/subsys/$NAME


NAMEJAVA=java
DAEMONJAVA=`which java`


# Exit if the package is not installed
if [ ! -x "$DAEMONJAVA" ]; then
{
  echo "Couldn‘t find $NAMEJAVA"
  exit 99
}
fi


start() {
        echo -n "Starting $DESC : "
        if [ "$(ps aux|grep -E "*/usr/local/logstash*" |grep -v grep)" != "" ];then
             echo "$desc already running...."
             exit 0
             
        else
        
        $LOCATION/bin/logstash -f  $CONFIG_DIR/logstash_agent.conf >$LOGFILE 2>&1  &
        RETVAL=$?
        sleep 3
        echo
            if [ "$(ps aux|grep -E "*/usr/local/logstash*" |grep -v grep)" != "" ];then
                echo "$DESC Started "
                [ $RETVAL -eq 0 ] && touch $LOCK_FILE
                return $RETVAL
            fi
        
        
        fi
       

}
stop() {
        echo -n $"Stop $DESC: "
        killall $NAMEJAVA
        RETVAL=$?
        sleep 3
        echo
        if [ "$(ps aux|grep -Eqi "*/usr/local/logstash*" |grep -v grep)" = "" ];then
                echo "$DESC Stoped "
                [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$NAME $PIDFILE
                return $RETVAL
        fi
       
}
restart() {
        stop
        start
}

case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart)
        restart
        ;;
  status)
        status $NAMEJAVA
        RETVAL=$?
        ;;
   *)
        echo $"Usage: $0 {start|stop|restart|status}"
        RETVAL=1
esac
exit $RETVAL
EOF






chmod +x /etc/init.d/logstash
#设置开机启动
chkconfig --add logstash
chkconfig logstash on