# Changing logstash.conf best practice?

**URL:** <https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710>\
**Category:** Logstash\
**Created:** [August 19, 2015, 9:06pm UTC](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710 "2015-08-19T21:06:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![russK](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@russK](https://discuss.elastic.co/u/russK)\
**Post date:** [August 19, 2015, 9:06pm UTC](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710/1 "2015-08-19T21:06:11Z")

</div>

When you have a new version of the logstash.conf file, and the current system is running in a 'production' environment; what is the best method to replace the .conf file on logstash while minimizing data loss and downtime?

It would appear from the documentation that stopping logstash, swapping .conf files, restarting logstash is the main method?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2015, 3:53am UTC](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710/2 "2015-08-20T03:53:49Z")

</div>

Logstash only reads the configuration file upon startup, so you can replace the file first and then bounce the service. Make sure you run `logstash --configtest` first so that you catch at least the most glaring configuration mistakes.

If you're running Logstash 1.4.x or older, keep in mind that stopping the service (implicitly done with a restart operation) doesn't ensure a clean shutdown, i.e. the message pipeline and sincedb files aren't flushed. You need to send a SIGINT signal for that to happen.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710/3 "2017-07-06T05:31:30Z")

</div>


