Is there any way to to put some messages on running logstash


(Chitresh Gargwanshi) #1

Hii all,
I recently started to learn logstash, I have created a simple configuration file as shown below. Logstash is working fine without any issue but is there any way to put some message to know the logstash process, because I'm not getting any message after running following configuration file [if permission of TextFile.txt is anything other then 644].
I want to put some output message on terminal like "The permission of file is changed".

// Code started from here

input{
        exec{
                command => "stat -c '%a %n' TextFile.txt"
                interval => 60
        }
}

filter{
        grok{
                match => {"message" => "%{NUMBER:access} %{GREEDYDATA:filename}"}
        }
}

output{
        if[access] == "644"
        {
                stdout{}
        }
        else
        {
                exec
                {
                        command => "chmod 644 TextFile.txt"
                        quiet => false
                }
        }
}

//command

bin/logstash -f demo.conf

//output

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2018-10-10T17:06:40,810][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-10-10T17:06:41,463][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.4.0"}
[2018-10-10T17:06:44,839][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-10-10T17:06:45,052][INFO ][logstash.inputs.exec ] Registering Exec Input {:type=>nil, :command=>"stat -c '%a %n' TextFile.txt", :interval=>60, :schedule=>nil}
[2018-10-10T17:06:45,065][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x4266411b run>"}
[2018-10-10T17:06:45,117][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2018-10-10T17:06:45,371][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9601}
[2018-10-10T17:06:45,373][INFO ][logstash.outputs.exec ]


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.