How to run multiple conf file continusly in backend

[mamta]

Hey,

I have installed ELK 5.6.8 version on Linux machine in a production environment. I have multiple conf files for each log.Currently I am running conf file from bin# ./logstash -f . I also tried to run from /etc/logstash/conf.d directory. I was tried to run conf file continuously by using nohup and crontab but at a time only one conf file is running continuously on the backend.
Can you please help me to run conf file continuously on the backend.

Thank you.

[warkolm (Mark Walkom)]

How did you install Logstash?

[mamta]

Through rpm packages

[warkolm (Mark Walkom)]

Then why not use service/systemctl?

[mamta]

I have used systemctl restart logstash , systemctl enable logstash, commands.
But my question is how I can run logstash.conf file continuously in back-end.

[warkolm (Mark Walkom)]

That's how you do it, if you put files in /etc/logstash/conf.d/ then the process will start and run them continuously.

If that is not happening, then perhaps you need to share a bit more info.

[mamta]

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf file from this location?
I have uploaded Apache error log conf file.

Thank you.

[warkolm (Mark Walkom)]

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them

[mamta]

Ok. Then how I can give you more info?

[warkolm (Mark Walkom)]

Copy and paste the text.

[mamta]

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf files from this location? I have uploaded my apache error log conf file.
Please look into it @warkolm .

input {
file {
path => "/var/log/httpd/error_log"
start_position => "beginning"
type => "logs"
}
}

filter {
grok { match => [ "message", "(?[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}]) [%{GREEDYDATA:loglevel}] [%{GREEDYDATA:pid}] %{GREEDYDATA:errormsg} %{GREEDYDATA:path}" ] }
}

output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "apache_errorlog"
}
}