Importing Logstash configuration from another file

Elastic Stack Logstash
1

Hi guys,
I was wondering if it is possible to include a Logstash configuration from a file to another one.
And if it is possible, what is the best way?
Below I will make an example about what I want to achieve.

In a configuration file, for example a.conf, I have the following basic configuration.

    input {
            syslog {
                    port => 5514
                    codec => plain { charset => "ISO-8859-1" }
            }
    }

    filter {
           ...include b.conf
    }

    output {
                    elasticsearch {
                            hosts => ["https://localhost:9200"]
                            index => "xxxx_%{+YYYY.MM.dd}"
                            user => "logstash_user"
                            password => "xxxxx"
                    }
    }

In b.conf, I have this code:

    grok {
            match => { "message" => "<134>@{%{GREEDYDATA:total_message}}" }
            tag_on_failure => [ "_grok_nomatch" ]
            add_tag => [ "_grok_success" ]
    }
    kv {
            source => "total_message"
            field_split_pattern => "; "
            tag_on_failure => [ "_kv_nomatch" ]
            add_tag => [ "_kv_success" ]
    }
    geoip {
            source => "ipAddress"
    }

So I would like to 'import' the b.conf configuration file in a.conf.

Regards,
Matteo.

2

If you point path.config to a directory then logstash will concatenate all the files in the directory into a single configuration. So you can approximate what you want by having a set of files

01input.conf
02b-filters.conf
03output.conf

Otherwise use a pre-processor to do includes, e.g. m4.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.