I have used logstash to build csv files, but I noticed i needed to exit logstash to be certain the output file is closed. While I am ok with this, it seems silly to have to shutdown logstash. The enclosed example is one that succeeded, so the answer isn't time critical.
I am running logstash 6.1 on linux ubuntu 16.04LTS server.
The task: read in a list of ip addresses from a file, and write them out with their locations.
path=>[ "/tmp/list_of_ips.csv" ]
start_position => beginning
sincedb_path => "/dev/null"
columns => [
source => "IP Address"
path => "/tmp/intel.output.csv"
fields => [
my question (multipart?)
Is there a way to have logstash complete (close) a csv file output when the input EOF is reached, or is exiting logstash the only option?
Would this change if the input was elasticsearch?