Installing Logstash on a Raspberry Pi

I tried to get a logstash instance running on a Raspberry Pi to send some weather data to my server for further analysis in an elasticsearch instance. Or for the sake of fancyness: I am doing the internet of things.

If you are lazy like me then you probably run Raspian, which should make installing logstash as easy as installing a deb package. Let's try this with:

curl -O https://download.elastic.co/logstash/logstash/packages/debian/logstash_2.3.2-1_all.deb
sudo dpkg -i logstash_2.3.2-1_all.deb

It should work without problems and if you have a recent Java installed, you can try to run

/opt/logstash/bin/logstash -h

Now you can grab a coffee or call some old friends because the JVM takes ages to start on a Raspberry Pi. I tried it on the Pi 1 but also on the Pi 2. It is superslow.

Anyway, after the JVM is booted and logstash is starting, I got the following error (I omitted tons of boring stack traces here):

LoadError: Could not load FFI Provider: (NotImplementedError) FFI not available: java.lang.UnsatisfiedLinkError: /tmp/jffi6455498535711576782.so: /tmp/jffi6455498535711576782.so: cannot open shared object file: No such file or directory
java.lang.UnsatisfiedLinkError: Can't load library: /usr/lib/libjffi-1.2.so
java.lang.UnsatisfiedLinkError: Can't load library: /lib/libjffi-1.2.so
java.lang.UnsatisfiedLinkError: Can't load library: /usr/java/packages/lib/arm/libjffi-1.2.so
java.lang.UnsatisfiedLinkError: /opt/logstash/vendor/jruby/lib/jni/arm-Linux/libjffi-1.2.so: /opt/logstash/vendor/jruby/lib/jni/arm-Linux/libjffi-1.2.so: cannot open shared object file: No such file or directory
See http://jira.codehaus.org/browse/JRUBY-4583
  require at org/jruby/RubyKernel.java:1040
   (root) at /opt/logstash/vendor/jruby/lib/ruby/shared/ffi/ffi.rb:69
  require at org/jruby/RubyKernel.java:1040
   (root) at /opt/logstash/vendor/jruby/lib/ruby/shared/ffi.rb:1
  require at org/jruby/RubyKernel.java:1040
   (root) at /opt/logstash/vendor/jruby/lib/ruby/shared/ffi.rb:1
   (root) at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/util/prctl.rb:1
  require at org/jruby/RubyKernel.java:1040
     LibC at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/util/prctl.rb:3
   (root) at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/util/prctl.rb:2
   (root) at /opt/logstash/lib/bootstrap/environment.rb:67

After some googling, I think I've found a GitHub issue which I cannot find anymore but basically it recommended recompiling jffi. So let's do that.

sudo apt-get install ant texinfo openjdk-8-jdk
git clone https://github.com/jnr/jffi.git
cd jffi
ant jar
sudo cp build/jni/libjffi-1.2.so /opt/logstash/vendor/jruby/lib/jni/arm-Linux

After some time, I was able to run logstash without problems.