How to handle Multiple Config files in logstash

[Arun_Raj]

Hi All

I am trying to load two different configurations (different data filters for each ) at a time on single command line

I tried the below :

from command line ( sudo bin/logstash -f /etc/logstash/conf.d/logstash.conf1 -f /etc/logstash/conf.d/logstash.conf2)

-f '/etc/logstash/conf.d/{logstash.conf1,logstash.conf2}'

It posts the data for logstash.conf2 only.

how can we add tags in input filed

for eg :

input {
file {
path => "\var\log\xs.log"
tags => [ "xs" ]
start_position => "beginning"

path => "\var\log\snmp.log"
tags => [ "snmp" ]
start_position => "beginning"
}
}

Please help

Thanks
Arun

[nugusbayevkk (nugusbayevk)]

hi, you can do as follow:
input {
file {
type => "file1"
...
}
file {
type> "file2"
....
}
}
filter {
if [type] == "file1" {
.. do something
}
if [type] == "file2" {
.. do something
}
}

output {
if [type] == "file1" {
write to elk or someting else ..
}
}

[Arun_Raj]

Thanks Kanagat I ll check it

[Christian_Dahlqvist]

In Logstash 6.0 you will be able to simplify this type of configuration as you can define multiple separate pipelines that can run side-by-side in a single Logstash instance.

[Arun_Raj]

# apache.cfg
input { beats { port => 3444 } }
filter { dissect { ... } }
output { elasticsearch { ... } }

here how can I give multiple log files ? can you pl help

[magnusbaeck (Magnus Bäck)]

Your Logstash doesn't read log files at all so the question of how to make it read multiple log files doesn't make sense. If you're using Filebeat to read your log files then that's the configuration you need to adjust.

[Arun_Raj]

here I m trying to input the log file directly to logstash

input{
file {
path => "/home/arun/xs.txt"
tags => [ "xs" ]
start_position => beginning
......
}
}
file {
path => "/home/arun/snmp.log"
tags => [ "snmp" ]
start_position => beginning
......
}
}

tried the above and got worked Is there any alternate / best way to do the same ?

[magnusbaeck (Magnus Bäck)]

Well, that's a completely different configuration. But yes, that's a good way of reading multiple log files. If they shouldn't be tagged differently you could list multiple filenames or patterns in the same file input.

[Arun_Raj]

thank you