Logstash init script fails to record PID when ARGS contain asterisks


Redirected from elasticsearch Github: https://github.com/elasticsearch/elasticsearch/issues/4767

I am using the logstash 1.3.2 RPM found in this repository:

I have set CONF_DIR to /etc/logstash/conf.d/**/*.conf.
The asterisks seem to be messing with the regular expression used by pgrep to find the PID of the process that was started.

The process starts fine, but then the process cannot be killed when using the stop command on the init script. When issuing a restart, there will be duplicate processes.
Escaping the asterisks for pgrep allowed me to get the pid.
Either the asterisks need to be escaped or a different value besides the full ARGS list should be used to find the PID.

Also, in a somewhat related issue. It seems that in the init script for logstash, reads the ${DAEMON} variable in a few places, but it is never set. I think ${DAEMON} should probably be the ${JAVA} variable.


Richard Pijnenburg
January 17, 2014, 3:55 PM


the ${DAEMON} part has to go indeed.
Someone already made a PR for that ( https://github.com/logstash/logstash/pull/936 ) just need to merge it. ( will do that later today )
For your primary issue, its something we haven't came across yet and will need to check out.
Do you have any idea's how we can solve it? ( PR's are always welcome )


Kevin Pearson
January 17, 2014, 4:35 PM

The way I fixed it was to change


This looks for /opt/logstash/logstash.jar in the process title. This wouldn't work if there are mutliple logstash processes launched with different args though. Not sure how valid of a use case that would be for other users.

Adam Peck
January 20, 2014, 8:07 PM

I have created a better pull request that fixes this bug as well:

Works with * or other special characters in the command.


Adam Peck


Kevin Pearson


Fix versions

Affects versions