Behaviour of logstash restart


(Kasun Siyambalapitiya) #1

I have a logstash setup configured for publishing events from a file (once a new record gets added into a log file) Currently the logstash process has stopped on my instance. What happens if I restart logstash, does it will start publishing from top of the file or from where it lastly published?. The instance which logstash was running haven't been restarted.

Thanks in advance


(Magnus Bäck) #2

What happens if I restart logstash, does it will start publishing from top of the file or from where it lastly published?

The depends on your configuration.


(Kasun Siyambalapitiya) #3

Hi magnusbaeck,

Thanks for the quick feedback. This is the configuration

input {
  file {
    path => "/opt/nginx/logs/updates.log"
    type => "updates_log"
  }
}

filter {
  if [type] == "updates_log" {
  mutate { replace => { "type" => "updates_log" } }
  grok {
    match => { "message" => "Message being sent" }
  }
  date {
    match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
  geoip {
    source => "clientip"
  }
}
}

output {
  if [type] == "updates_log" {
          http  {
    url => "URL of the receiver"
    http_method => "post"
    format => "json"
    headers => [
      'Authorization', 'Basic sampleBearer’
    ]
  }
}
}

Will it start publishing from top of the file once logstash is restarted?

Thanks in advance


(Magnus Bäck) #4

Will it start publishing from top of the file once logstash is restarted?

No. The file input documentation describes this in detail.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.