Logstash and Elasticsearch use the /tmp folder to temporarily store some modules and execute them. This causes issues with installations that have the /tmp folder mounted with noexec. If this situation is detected, the installation will notify the user about the recommended course of action.
During the installation process, the Admin should allow the /tmp folder to execute by using the TMPDIR environment variable to override the default temporary folder. This will allow the installation to complete with no errors.
After the installation is complete, the Admin should change the global parameter to a different folder that will be used as the temp for these modules. To do so, follow these steps:
Add -Djava.io.tmpdir=<tmp dir> to
/etc/logstash/jvm.options
/etc/elasticsearch/jvm.options
Restart the services by running the following command:
sudo systemctl restart logstash elasticsearch