Logstash can be installed using yum or dnf though it first requires adding Elasticsearch repository which is provided by Elastic, the company behind the Elastic Stack. Logstash is a Java program thus it requires Java Runtime Environment or JRE to also be installed for it to run.

JRE is not installed automatically as a dependency when installing Logstash so it need to be installed separately. Both Logstash and JRE can be installed on CentOS, RHEL or Fedora using yum or dnf from the terminal.

Steps to install Logstash on CentOS, RHEL or Fedora:

  1. Launch terminal.
  2. Download and install public signing key for ELK's yum repository.

    $ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

  3. Add ELK repository for yum / dnf.

    $ sudo tee /etc/yum.repos.d/elasticsearch.repo <<EOF [elasticsearch-7.x] name=Elasticsearch repository for 7.x packages baseurl=https://artifacts.elastic.co/packages/7.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md EOF

  4. Install latest Java Runtime Environment.

    $ sudo dnf install --assumeyes java-11-openjdk [sudo] password for user:  Last metadata expiration check: 1 day, 0:28:04 ago on Fri 30 Apr 2021 07:01:52 AM +08. Dependencies resolved. ================================================================================  Package                  Arch   Version                        Repo       Size ================================================================================ Installing:  java-11-openjdk          x86_64 1:       appstream 260 k Installing dependencies:  copy-jdk-configs         noarch 3.7-4.el8                      appstream  27 k  java-11-openjdk-headless x86_64 1:       appstream  39 M  javapackages-filesystem  noarch 5.3.0-1.module_el8.0.0+11+5b8c10bd                                                                 appstream  30 k  lksctp-tools             x86_64 1.0.18-3.el8                   baseos    100 k  ttmkfdir                 x86_64 3.0.9-54.el8                   appstream  62 k  tzdata-java              noarch 2021a-1.el8                    appstream 192 k  xorg-x11-fonts-Type1     noarch 7.5-19.el8                     appstream 522 k Enabling module streams:  javapackages-runtime            201801                                          Transaction Summary ================================================================================ Install  8 Packages  Total download size: 41 M Installed size: 173 M ##### snipped

  5. Install logstash package via dnf.

    $ sudo dnf install --assumeyes logstash Last metadata expiration check: 2:52:17 ago on Sat 01 May 2021 07:34:39 AM +08. Dependencies resolved. =================================================================================================  Package             Architecture      Version                Repository                    Size ================================================================================================= Installing:  logstash            x86_64            1:7.12.1-1             elasticsearch-7.x            353 M  Transaction Summary ================================================================================================= Install  1 Package  Total download size: 353 M Installed size: 607 M ##### snipped

  6. Configure logstash options as necessary.

    $ sudo vi /etc/logstash/logstash.yml

  7. Configure logstash to automatically start during system boot.

    $ sudo systemctl enable logstash Created symlink /etc/systemd/system/multi-user.target.wants/logstash.service → /etc/systemd/system/logstash.service.

  8. Start logstash service.

    $ sudo systemctl start logstash