Logstash 5.0.0 - Need to stop the logstash agent once parsing is completed

Hi.

I am building a EL as a service for a specific set of users. The logs that I parse are often not real time logs and I would like to stop the logstash agent as soon as all of the logs are parsed.

How do I achieve the stopping of the logstash once the agent has parsed the entire log uploaded by the user.

I did find one blog which did this, but was not really to make sense of it. So posting this question here.

How do I achieve the stopping of the logstash once the agent has parsed the entire log uploaded by the user.

There's no built-in support for this. You can read the file input's state files, the sincedb files, to figure out Logstash's current position in each file. You can also consider using the stdin input instead of the file input.

I did find one blog which did this, but was not really to make sense of it.

If you post the URL maybe we can help you make sense of it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.