How to run multiple conf file continusly in backend


(Mamta ) #1

Hey,

I have installed ELK 5.6.8 version on Linux machine in a production environment. I have multiple conf files for each log.Currently I am running conf file from bin# ./logstash -f . I also tried to run from /etc/logstash/conf.d directory. I was tried to run conf file continuously by using nohup and crontab but at a time only one conf file is running continuously on the backend.
Can you please help me to run conf file continuously on the backend.

Thank you.


(Mark Walkom) #2

How did you install Logstash?


(Mamta ) #3

Through rpm packages


(Mark Walkom) #4

Then why not use service/systemctl?


(Mamta ) #5

I have used systemctl restart logstash , systemctl enable logstash, commands.
But my question is how I can run logstash.conf file continuously in back-end.


(Mark Walkom) #6

That's how you do it, if you put files in /etc/logstash/conf.d/ then the process will start and run them continuously.

If that is not happening, then perhaps you need to share a bit more info.


(Mamta ) #7

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf file from this location?
I have uploaded Apache error log conf file.


Thank you.


(Mark Walkom) #8

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them :slight_smile:


(Mamta ) #9

Ok. Then how I can give you more info?


(Mark Walkom) #10

Copy and paste the text.


(Mamta ) #11

Hey,
In /etc/logstash/conf.d directory I have kept only one conf file and I start logstash by using systemctl restart logstash but the file was not running at-least for once. Will it possible to run multiple conf files from this location? I have uploaded my apache error log conf file.
Please look into it @warkolm .

input {
file {
path => "/var/log/httpd/error_log"
start_position => "beginning"
type => "logs"
}
}

filter {
grok { match => [ "message", "(?[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}]) [%{GREEDYDATA:loglevel}] [%{GREEDYDATA:pid}] %{GREEDYDATA:errormsg} %{GREEDYDATA:path}" ] }
}

output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "apache_errorlog"
}
}


(system) #12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.