title: Logstash (ELK) in an LXC Container - ulimit error
body: <p>I've got ELK set up in an LXC container on 3.13 (Ubuntu 14.04.2) and I assume that it's configured correctly (no errors in logs or otherwise). That being said, when ever I try to fire up LogStash, I get the following error
  <code>/etc/init.d/logstash: 55: ulimit: error setting limit (Operation not permitted)</code></p>
  
  <p>Yes, I'm root when I run the command. Same error running <code>service start logstash</code></p>
  
  <p>Despite the error, I see <code>logstash started.</code> right after. But, a quick netstat clearly shows that Logstash isn't listening (Yes, I've tried shoving logs at it anyway to no avail)...</p>
  
  <pre><code>Active Internet connections (only servers)
  Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
  tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      6523/nginx      
  tcp6       0      0 :::9200                 :::*                    LISTEN      5890/java       
  tcp6       0      0 :::9300                 :::*                    LISTEN      5890/java       
  udp        0      0 0.0.0.0:68              0.0.0.0:*                           303/dhclient    
  udp        0      0 0.0.0.0:44889           0.0.0.0:*                           303/dhclient    
  udp6       0      0 :::2274                 :::*                                303/dhclient    
  udp6       0      0 :::54328                :::*                                5890/java 
  </code></pre>
  
  <p>Thoughts on how to fix this? I'm reasonably certain that it's an LXC issue due to <code>ulimit</code> puking, but I'm not sure how to remedy.</p>
  
  <p>Edit: Further reading tells me that it is indeed a ulimit issue. I've gone ahead upped my user limits to more than 16384 (what logstash init wants), but I'm still getting the issue after restarting the container. My <code>/etc/security/limits.conf</code> has the following lines appended</p>
  
  <pre><code>user          soft    nofile          24576
  user          hard    nofile          24576
  </code></pre>