We are currently trying to increase the number of servers we log using filebeat and logstash in stages.
Filebeat can be installed on a new logging server, and logstash can send logs to the installed server.
logstash is already installed on the server, we can send the logs to it.
What is the recommended procedure for a logstash that is already running?
Just editing the logstash config file will not enable the newly added filebeat.
I ran logstash again, specifying the edited config file.
/usr/share/logstash/bin/logstash -f /etc/logstash/logstash-sample.conf &
At this time, I get the message "logstash is already running", so the logstash with the added configuration will not simply run.
I've tried stopping logstash, killing the process, and then running it again, but
I don't think this is a good idea.
Please let me know what I can do.