Logstash version: 5.0.1;
when I have many logstash conf files, how can I start these conf files as soon as quickly?
not start these conf files like : /path/logstash/bin/logstash -f /path/xxxx.conf
Thx so much !!!
Put the files in a directory and pass -f /path/to/directory to Logstash.
Keep in mind that except if you use the multi-pipeline feature in Logstash 6 there is a single event pipeline. If you don't want events from config file 1 to "spill over" into config file 2 you need to use conditionals.
Thx Magnus Bäck so much !
I have another question, how can I monitor all these different conf status? so i can know which conf works nomally or not ???
It depends. What does normal mean? How would you as a human determine whether things are working okay?
I mean that all the input conf , filter conf and output conf files can work normally.
for example, i have windows data source input , filter and relevant output conf file, so how can i know these conf files work normally ? when i have so many different data sources , so in the directory have so many conf files.
I don't know you can understand me now!
thanks !
Oh, okay. Have a look at a tool I wrote, https://github.com/magnusbaeck/logstash-filter-verifier. It allows you to write testcases that verify a Logstash configuration.
Apart from that you should of course inspect what the outputs receive to make sure it looks reasonable, but I find that the filters are the hard part. Once you get them right the rest is pretty easy and any problems are immediately visible.
Got it ! Thank you so much !!!
Dear magnusbaeck,
I put the logstash files including one input file , some different filter files and one output file in a directory and pass -f /path/to/directory to start them
So i want to know, when to add another filter conf file to the /path/to/directory to process the data source , how can I to restart them ? like : pass -f /path/to/directory to restart them ????
You mean you want to process the original files (read via the file input) again? You'll have to clear the sincedb file and make sure your file input includes start_position => "beginning". See the file input documentation for more on sincedb.
the input file like this :
input {
tcp {
port => 514
}
}
because i have a few different types of data to send the same tcp port , so i need to use different filter conf to process , after i add the new filter conf file to the /path/to/directory , how can i load this filter to logstash? only to restart it ? can it influence the old data type ?
only to restart it ?
Yes, unless you have automatic configuration reload enabled.
can it influence the old data type ?
That depends on exactly what your configuration looks like.
ok ， thank you !
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.