Install Logstash shipper on RedHat 5.4+

by Ravi Hasija

Installing Logstash on older versions of RedHat can be a real pain. If you are struck with the familiar LoadError: Could not load FFI Provider: (NotImplementedError) FFI not available: null then follow on!

First things first how to install Logstash on RedHat 5.4:

sudo rpm -Uvh http://download.elasticsearch.org/logstash/logstash/packages/centos/logstash-1.4.2-1_2c0f5a1.noarch.rpm --nodeps

This will install logstash in /opt/logstash/

[ravi1114@web-3-stag ~]$ ll /opt/logstash/
total 40
drwxr-xr-x  2 logstash logstash 4096 Dec  9 14:49 bin
drwxr-xr-x  3 logstash logstash 4096 Dec  8 13:54 lib
-rw-rw-r--  1 logstash logstash  591 Jun 24 07:41 LICENSE
drwxr-xr-x  2 logstash logstash 4096 Dec  8 13:54 locales
drwxr-xr-x  2 logstash logstash 4096 Dec  9 11:58 logs
drwxr-xr-x  2 logstash logstash 4096 Dec  8 13:54 patterns
-rw-rw-r--  1 logstash logstash 3450 Jun 24 07:41 README.md
drwxr-xr-x 10 logstash logstash 4096 Dec  8 13:54 spec
drwxrwxr-x  2 logstash logstash 4096 Jun 24 07:41 tmp
drwxr-xr-x  8 logstash logstash 4096 Dec  8 13:54 vendor
[ravi1114@web-3-stag ~]$

And have init script in /etc/init.d/logstash.

But when you run the logstash service (sudo service logstash start) it would fail to start and you can check /var/log/logstash directory for log output. There you would find:

LoadError: Could not load FFI Provider: (NotImplementedError) FFI not available: null in logstash.log or logstash.err

This is a red herring. The real issue is it cannot access a mounted directory. To fix it, I changed java.io.tmpdir to point to a location which it can access. In this instance it was /opt/application/logstash/tmp

LS_OPT=/opt/application/logstash/tmp
LS_JAVA_OPTS="-Djava.io.tmpdir=${LS_OPT}"

Boom! That fixed the LoadError: Could not load FFI Provider: (NotImplementedError) FFI not available: null issue.

You might also face an issue with chroot command not working. Specifically the message would be like: chroot: invalid option -- -

[UPDATE: 1/13/2015]

To fix it remove `chroot --user $LOGSTASH_USER:$LOGSTASH_` command from `/etc/init.d/logstash` and you should be set.

Let me know if you have any issues inspite of these tips! Thank you for your time!