# Dynamically add GROK rules to logstash **URL:** \ **Category:** Elasticsearch\ **Created:** [August 12, 2014, 3:52am UTC](https://discuss.elastic.co/t/dynamically-add-grok-rules-to-logstash/19217 "2014-08-12T03:52:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![vineeth\_mohan\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vineeth_mohan_2/32/747_2.png) [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Post date:** [August 12, 2014, 3:52am UTC](https://discuss.elastic.co/t/dynamically-add-grok-rules-to-logstash/19217/1 "2014-08-12T03:52:35Z")
Hi , I have various GROK rules which will identify mark various log lines based on certain rules. Currently on adding a new GROK rule , we need to restart logstash. Is there a way to do it , without restarting logstash , i.e. dynamically change or add the GROK conf file. Thanks Vineeth -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me\_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 12, 2014, 3:53am UTC](https://discuss.elastic.co/t/dynamically-add-grok-rules-to-logstash/19217/2 "2014-08-12T03:53:53Z")
Nope, you need to restart logstash for it to pick up the new config. Regards, Mark Walkom Infrastructure Engineer Campaign Monitor email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) web: [www.campaignmonitor.com](http://www.campaignmonitor.com) On 12 August 2014 13:52, vineeth mohan [vm.vineethmohan@gmail.com](mailto:vm.vineethmohan@gmail.com) wrote: > Hi , > > I have various GROK rules which will identify mark various log lines based > on certain rules. > Currently on adding a new GROK rule , we need to restart logstash. > Is there a way to do it , without restarting logstash , i.e. dynamically > change or add the GROK conf file. > > Thanks > Vineeth > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me\_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com) > [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me\_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5me_vRn9z0cpGao4iTTZqp3GRoiXLh7sKPjDAR8T66sLQ%40mail.gmail.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624ZVBBVvUerDpqNiV0O%2B%3DxortMDEznF5g1-rqDypw9BMog%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624ZVBBVvUerDpqNiV0O%2B%3DxortMDEznF5g1-rqDypw9BMog%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:09am UTC](https://discuss.elastic.co/t/dynamically-add-grok-rules-to-logstash/19217/3 "2017-07-06T01:09:24Z")
Closed on July 6, 2017, 1:09am UTC