Centralized pipeline configuration lost after license expiry - is there a way to get it back? [Solved]

[dswinton (David Swinton)]

Hi Guys,

I've been googling and picking through my Logstash server to try to fix this issue for a couple of hours now and have come up with nothing...

I spent quite a bit of time writing an extensive set of pipeline rules using the centralized configuration feature of X-Pack in Kibana. Previously I had just written them in configuration files, but made the switch so I could edit them more easily in the web UI.

Unfortunately, I didn't realise that the centralised management feature was a paid feature, so as soon as my trial expired those configuration options have now disappeared and my Logstash instance has lost it's configuration. I looked into buying a license, but it's way, WAY out of my price range.

Is there a way to retrieve the pipeline configuration stored in the Centralized Configuration feature so I can just drop it into a text configuration file?

Thanks in advance!

[shaunak (Shaunak Kashyap)]

Hmmmm, I haven't tested this but you should be able to make the following request to Elasticsearch:

GET .logstash/_search

This should return your pipeline configurations in the response. If you stored more than 20 pipelines in centralized configuration management, just append ?size=<number_of_pipelines> to your request.

[dswinton (David Swinton)]

Hi @shaunak,

That worked perfectly - thank you very much!

All the pipeline were output by this command. All I had to do was remove some extra escaping from the output, and drop the pipelines into text configuration files.

My Logstash box is now back up and running.
Very much appreciate your help!