# How to configure the output section in logstash conf make copy of logs on my local disk **URL:** \ **Category:** Logstash\ **Created:** [November 28, 2017, 12:28pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383 "2017-11-28T12:28:07Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Post date:** [November 28, 2017, 12:28pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/1 "2017-11-28T12:28:07Z")
Hi, How can i get copy or output of parsed logs in logstash on my local disk? Our Case: We are thinking not just send logs to Elasticsearch by logstash also to have output from logs on our disk, then we have backup/archive system of our logs. In case of data loss/ELk failure we dont want to end up with losing some of the important events in our system. So how we can implement this request? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 28, 2017, 3:50pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/2 "2017-11-28T15:50:53Z")
Just add a file output to your output section. You'll probably want to set the codec to json\_lines. Why not just back up the Elasticsearch indexes instead of storing the log copies as flat files? ---
**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Post date:** [November 28, 2017, 4:46pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/3 "2017-11-28T16:46:31Z")
So this can be the solution output { file { path =\> ... codec =\> line { format =\> "custom format: %{message}"} } } or Do you prefer second method Elasticsearch indexes' backup? another question please. If i have log files for two years and i want the logstash just send the last two weeks logs to the elasticsearch, how we can do this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 28, 2017, 7:12pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/4 "2017-11-28T19:12:09Z")
> So this can be the solution If you want to capture the whole event the line codec won't do. My suggestion is still json\_lines. I'd prefer backing up the ES data. > If i have log files for two years and i want the logstash just send the last two weeks logs to the elasticsearch, how we can do this? You can use a conditional wrapping a drop filter that compares the `@timestamp` field to a fixed timestamp. ---
**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Post date:** [November 28, 2017, 8:15pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/5 "2017-11-28T20:15:32Z")
Really i appreciate your efforts to help and make it easier for community ---
**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Post date:** [November 29, 2017, 12:15pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/6 "2017-11-29T12:15:00Z")
Hi @magnusbaeck, I tested your suggestion with json\_lines and now i have file output on my disk by using following output code: output { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } file { path =\> "/path/backup-logs/BackupSyslog-%{+YYYY-MM-dd}.log" #codec =\> line { format =\> "custom format: %{message}"} #codec =\> "rubydebug" codec =\> "json\_lines" } } I have two more questions: 1- How to compress this file output by using gzip / Gzip the output stream before writing to disk? Is it correct to use this gzip =\> true where to use the drop filter? in output section or in filter section? Please if you have sample script of using drop filter with elasticsearch output! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 29, 2017, 1:00pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/7 "2017-11-29T13:00:41Z")
> I have two more questions: > 1- How to compress this file output by using gzip / Gzip the output stream before writing to disk? > Is it correct to use this > gzip =\> true Yes. > where to use the drop filter? in output section or in filter section? Filters are always in the filter section. > Please if you have sample script of using drop filter with elasticsearch output! Have a look at the age filter: [age | Logstash Reference [5.4] | Elastic](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-age.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2017, 1:01pm UTC](https://discuss.elastic.co/t/how-to-configure-the-output-section-in-logstash-conf-make-copy-of-logs-on-my-local-disk/109383/8 "2017-12-27T13:01:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.