Logstash init.d script and config file. Ubuntu script is borrowed from http://www.vmdoh.com/blog/centralizing-logs-lumberjack-logstash-and-elasticsearch SuSe script is for SLES. Just copy the script to /etc/init.d as logstash

logstash-suse

#! /bin/sh
### BEGIN INIT INFO
# Provides:          logstash
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO
 
. /lib/lsb/init-functions
 
name="logstash"
LOGSTASH_JAR="/opt/logstash/logstash.jar"
JAVA_BIN="/usr/bin/java"
LOGSTASH_BIN="$JAVA_BIN -jar $LOGSTASH_JAR"
LOGSTASH_CONF="/etc/logstash/logstash.conf"
LOGSTASH_LOG="/var/log/logstash.log"
PID_FILE="/var/run/$name.pid"

# check for logstash jar
test -f $LOGSTASH_JAR || { echo "$LOGSTASH_JAR does not exist";
        if [ "$1" = "stop" ]; then exit 0;
        else exit 5; fi; }


# Check for configuration file
test -f $LOGSTASH_CONF || { echo "$LOGSTASH_CONF does not exist";
        if [ "$1" = "stop" ]; then exit 0;
        else exit 5; fi; }

# Load the rc.status script for this service.
. /etc/rc.status

# Reset status of this service
rc_reset

case $1 in
        start)
                echo -n "Starting $name: "
                command="${LOGSTASH_BIN} agent -f $LOGSTASH_CONF --log ${LOGSTASH_LOG}"
                #echo $command
                pid=$(startproc -v -l $LOGSTASH_LOG -p $PID_FILE $command)

                # Remember status and be verbose
                rc_status -v
                if [[ "$pid" =~ ^[0-9]+$ ]]; then
                  echo $pid > $PID_FILE
                else
                  exit 1
                fi
                ;;
        stop)
                echo -n "Stopping $name: "
                ## Stop daemon with killproc(8) and if this fails
                ## killproc sets the return value according to LSB.
                killproc -p $PID_FILE -TERM $JAVA_BIN

                # Remember status and be verbose
                rc_status -v

                ;;
        restart)
                echo -n "Restarting $name: "
                ## Stop the service and regardless of whether it was
                ## running or not, start it again.
                $0 stop
                $0 start

                # Remember status and be quiet
                rc_status
                ;;
 
        status)
                echo -n "Status for $name:"
                ## Check status with checkproc(8), if process is running
                ## checkproc will return with exit status 0.

                # Status has a slightly different for the status command:
                # 0 - service running
                # 1 - service dead, but /var/run/  pid  file exists
                # 2 - service dead, but /var/lock/ lock file exists
                # 3 - service not running

                # NOTE: checkproc returns LSB compliant status values.
                checkproc -p $PID_FILE $JAVA_BIN
                 # NOTE: rc_status knows that we called this init script with
                # "status" option and adapts its messages accordingly.
                rc_status -v
                ;;
        *)
                echo "Usage: $0 {start|stop|restart|status}"
                exit 1
                ;;
esac
 
exit 0

logstash-ubuntu

#! /bin/sh
 
### BEGIN INIT INFO
# Provides:          logstash
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO
 
. /lib/lsb/init-functions
 
name="logstash"
logstash_bin="/usr/bin/java -- -jar /opt/logstash/logstash.jar"
logstash_conf="/etc/logstash/logstash.conf"
logstash_log="/var/log/logstash.log"
pid_file="/var/run/$name.pid"
 
start () {
        command="${logstash_bin} agent -f $logstash_conf --log ${logstash_log}"
 
        log_daemon_msg "Starting $name" "$name"
        if start-stop-daemon --start --quiet --oknodo --pidfile "$pid_file" -b -m --exec $command; then
                log_end_msg 0
        else
                log_end_msg 1
        fi
}
 
stop () {
        log_daemon_msg "Stopping $name" "$name"
        start-stop-daemon --stop --quiet --oknodo --pidfile "$pid_file"
}
 
status () {
        status_of_proc -p $pid_file "" "$name"
}
 
case $1 in
        start)
                if status; then exit 0; fi
                start
                ;;
        stop)
                stop
                ;;
        reload)
                stop
                start
                ;;
        restart)
                stop
                start
                ;;
        status)
                status && exit 0 || exit $?
                ;;
        *)
                echo "Usage: $0 {start|stop|restart|reload|status}"
                exit 1
                ;;
esac
 
exit 0

logstash.conf

input {
file {
      path => "/opt/apps/myapp/log/logstash_development.log"
      type => "rails"
      format => "json_event"
}
lumberjack {
    type => "lumberjack"
    debug => true
    format => "json_event"
    port => 5555
    ssl_certificate => "/etc/ssl/logstash.crt"
    ssl_key => "/etc/ssl/logstash.key"
  }
}
output {
  elasticsearch { 
   embedded => true
  }
  email {
        tags => ['exception']
        match => [ "exception status", "status,*" ]
        to => "[email protected]"
        options => [ "smtpIporHost", "mail.mydomain.com",
                     "port", "25",
                     "domain", "mail.mydomain.com"]
        from => '[email protected]'
        via => "smtp"
        subject => "Exception on %{route}"
        body => "User : %{user}\nException:\n %{error}"
    }
}