启动Logstash遇FFI不可用错误求助：FFI not available: null

启动Logstash时程序终止，错误日志如下：

[FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (LoadError) Could not load FFI Provider: (NotImplementedError) FFI not available: null
 See http://jira.codehaus.org/browse/JRUBY-4583
org.jruby.exceptions.LoadError: (LoadError) Could not load FFI Provider: (NotImplementedError) FFI not available: null
 See http://jira.codehaus.org/browse/JRUBY-4583
    at org.jruby.ext.jruby.JRubyUtilLibrary.load_ext(org/jruby/ext/jruby/JRubyUtilLibrary.java:216) ~[jruby.jar:?]
    at RUBY.<main>(/opt/logstash/vendor/bundle/jruby/2.6.0/gems/ffi-1.15.5-java/lib/ffi.rb:11) ~[?:?]
    at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1017) ~[jruby.jar:?]
    at RUBY.<module:LibC>(/opt/logstash/logstash-core/lib/logstash/util/prctl.rb:19) ~[?:?]
    at RUBY.<main>(/opt/logstash/logstash-core/lib/logstash/util/prctl.rb:18) ~[?:?]
    at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1017) ~[jruby.jar:?]
    at opt.logstash.logstash_minus_core.lib.logstash.util.set_thread_name(/opt/logstash/logstash-core/lib/logstash/util.rb:36) ~[?:?]
    at RUBY.execute(/opt/logstash/logstash-core/lib/logstash/runner.rb:354) ~[?:?]
    at opt.logstash.vendor.bundle.jruby.$2_dot_6_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/opt/logstash/vendor/bundle/jruby/2.6.0/gems/clamp-1.0.1/lib/clamp/command.rb:68) ~[?:?]
    at opt.logstash.logstash_minus_core.lib.logstash.runner.run(/opt/logstash/logstash-core/lib/logstash/runner.rb:282) ~[?:?]
    at opt.logstash.vendor.bundle.jruby.$2_dot_6_dot_0.gems.clamp_minus_1_dot_0_dot_1.lib.clamp.command.run(/opt/logstash/vendor/bundle/jruby/2.6.0/gems/clamp-1.0.1/lib/clamp/command.rb:133) ~[?:?]
    at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]
Caused by: org.jruby.exceptions.NotImplementedError: (NotImplementedError) FFI not available: null

预期Logstash能正常启动运行，需排查解决该问题。

排查解决步骤 #

1. 检查Java版本兼容性 #

Logstash对Java版本有严格要求，确保使用官方推荐的JDK版本（通常为OpenJDK 11或17，具体匹配你的Logstash版本）：

• 执行命令检查当前Java版本：java -version
• 若版本不符，卸载现有Java后安装对应版本的OpenJDK。

2. 安装系统依赖库 #

FFI依赖系统底层库，需确保系统已安装必要依赖：

• Debian/Ubuntu系统：sudo apt-get install libffi-dev
• RHEL/CentOS系统：sudo yum install libffi-devel

3. 清理并重建Logstash依赖 #

• 停止Logstash服务：sudo systemctl stop logstash
• 删除现有vendor bundle目录：rm -rf /opt/logstash/vendor/bundle
• 重新运行Logstash的依赖安装脚本（源码安装场景），或重新安装Logstash包。

4. 临时绕过FFI线程名称限制 #

若上述方法无效，可临时禁用线程名称设置：

• 在/etc/logstash/jvm.options文件中添加配置：-Dlogstash.util.prctl.disable=true
• 重启Logstash服务：sudo systemctl restart logstash

5. 验证版本与系统架构匹配 #

确保下载的Logstash版本与系统架构（x86_64/arm64）完全一致，避免因架构不兼容导致FFI加载失败。

内容的提问来源于stack exchange，提问作者Ahlem Azzouz