How to run multiple conf file continusly in backend

Hey,

I have installed ELK 5.6.8 version on Linux machine in a production environment. I have multiple conf files for each log.Currently I am running conf file from bin# ./logstash -f . I also tried to run from /etc/logstash/conf.d directory. I was tried to run conf file continuously by using nohup and crontab but at a time only one conf file is running continuously on the backend.
Can you please help me to run conf file continuously on the backend.

Thank you.

How did you install Logstash?

Through rpm packages

Then why not use service/systemctl?

I have used systemctl restart logstash , systemctl enable logstash, commands.
But my question is how I can run logstash.conf file continuously in back-end.

That's how you do it, if you put files in /etc/logstash/conf.d/ then the process will start and run them continuously.

If that is not happening, then perhaps you need to share a bit more info.

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf file from this location?
I have uploaded Apache error log conf file.


Thank you.

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them :slight_smile:

Ok. Then how I can give you more info?

Copy and paste the text.

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf files from this location? I have uploaded my apache error log conf file.
Please look into it @warkolm .

input {
file {
path => "/var/log/httpd/error_log"
start_position => "beginning"
type => "logs"
}
}

filter {
grok { match => [ "message", "(?[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}]) [%{GREEDYDATA:loglevel}] [%{GREEDYDATA:pid}] %{GREEDYDATA:errormsg} %{GREEDYDATA:path}" ] }
}

output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "apache_errorlog"
}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.