How to show the pipeline conf source filename of error in logs

Hello,
We have multiple logstash conf files that we run simultaneously, the problem is that when we have many errors come from several pipelines, so we can't tell which one is the source of the error, sometimes it's easy to tell but with time it is becoming more complicated.

Example of logs

Can you tell me if its possible to show the name (or id) of the pipeline as info in logs? and how to do it?
Thanks in advance.

Use the pipeline.separate_logs option in logstash.yml.

Logstash.yml

# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
#
# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name
# Default is false
pipeline.separate_logs: true
1 Like

I tried that but I got this error:

[2022-04-12T18:13:31,966+02:00][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<ArgumentError: Setting "pipeline.separate_logs" hasn't been registered>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:36:in `get_setting'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:69:in `set_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:88:in `block in merge'", "org/jruby/RubyHash.java:1343:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:88:in `merge'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:137:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:278:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:237:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in `<main>'"]}
[2022-04-12T18:13:32,046+02:00][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

is it the version of logstash that doesn't support this or an extra config that I should add, if it's the version, are there any other options to show the name / id of the pipeline in the global log file,
Thanks!

Can you share the full logstash.yml?

---
# ------------  Node identity ------------
node.name: "host-logstash"

# ------------ Data path ------------------
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
path.data: /var/lib/logstash

# ------------ Queuing Settings --------------
queue.type: memory

# ------------ Metrics Settings --------------
# Bind address for the metrics REST endpoint
http.host: 0.0.0.0
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
http.port: 9600-9700
#
# ------------ Debugging Settings --------------
# Options for log.level:
#   * fatal
#   * error
#   * warn
#   * info (default)
#   * debug
#   * trace
#
log.level: trace
path.logs: /var/log/logstash

pipeline.separate_logs: true
#
# ------------ Other Settings --------------
xpack.monitoring.enabled: false
xpack.monitoring.elasticsearch.url: ["host-elasticsearch.intra:9200"]
xpack.monitoring.elasticsearch.sniffing: false
xpack.monitoring.elasticsearch.username: "username"
xpack.monitoring.elasticsearch.password: "password"
xpack.monitoring.elasticsearch.ssl.ca: /etc/logstash/ssl/ca/Bundle.crt
xpack.monitoring.elasticsearch.ssl.keystore.path: /etc/logstash/ssl/logstash/logstash.p12
xpack.monitoring.elasticsearch.ssl.keystore.password: "ssl_password"

Was the service restarted or just the config reloaded? There should be more info in the logs.

Per-pipeline logging was added in 7.5.0. If you are running something older you cannot use it.

1 Like

We restart the service each time we change the config

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.