In logstash previous 5.x, it was possible to specify the input/filter/output blocks in different configuration files (in conf.d/ directory).
With 5.x, apparently this isn't possible anymore, it will terminate when there is no configuration file with both, input + output block.
I noticed this issue when migrating some config for logstash 2.x to logstash 5.x.
This is a quite useful feature because it is easily possible adding extra config as single files, like ruby debug (like for a Docker container).
root@elastic5:/etc/logstash/conf.d# cat input.conf output.conf
input {
stdin {}
}
output {
stdout {
codec => rubydebug
}
}
root@elastic5:/etc/logstash/conf.d# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
The stdin plugin is now waiting for input:
07:17:13.202 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
07:17:13.229 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
07:17:13.303 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
help
{
"@timestamp" => 2016-11-20T07:17:29.387Z,
"@version" => "1",
"host" => "elastic5",
"message" => "help",
"tags" => []
}
^C07:17:31.483 [SIGINT handler] WARN logstash.runner - SIGINT received. Shutting down the agent.
07:17:31.518 [LogStash::Runner] WARN logstash.agent - stopping pipeline {:id=>"main"}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.