Logstash change port

Elastic Stack Logstash
1

Logstash is running on 9600 by default and I want to run another logstash on same system
Is there opion to change default port for logstash
I don't want to use beats for this.
beacuse I want to run two logstash with different conf files
and
If have change configuration in conf file I want to get data from already present files.
Logstash is taking those files but elastic isn't. Can anyone help me??

2

You can with multiple Logstash Inputs... eg

Also with multiple protocols

input 
{
    tcp 
    {
        id => "main_tcp"
        port => "5043"
        codec => json
    }

    udp
    {
        id => "main_udp"
        port => 12201
        codec => "json"
    }
}

Logstash will bind to what you specify in the *.conf files

3

I found the solution
by editing logstash.yml file at config dir

http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
http.port: 9650

but now already existing files are not indexing

4

That is for a different endpoint, the ports for ingesting data are controlled via the inputs modules, where 5044 is default. You are looking at the Logstash Configuration instead of the pipeline configuration

5 
input {
	file{
		path => "/logs/archived/*.log"
		codec => multiline{
			pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2}"
			negate => true
			what => "previous"
	}
  }
}
filter{
	grok {
		match => {"message" => "%{TIMESTAMP_ISO8601:time_stamp}\s%{WORD:log_level}\s%{JAVACLASS:class}\s(\[%{DATA:thread}\])\s+(?<msg>(.|\r|\n)*)"}
	}
	mutate{
		gsub => ["time_stamp", " ", "T"]
	}
	mutate{
		gsub => ["time_stamp", ",", "."]
	}
	mutate{
		replace => {"time_stamp" => "%{time_stamp}Z"}
	}
}
output{
	stdout{
		codec => rubydebug
	}
	elasticsearch {
		hosts => ["http://0.0.0:9200"]
		index => "index-log"
  }
}

I am taking files from this path and if I made changes in config file I want to index already present files again

1 Like
6

If you are using logstash to ingest a file, why do you need to change the logstash port number (5044)?

7

I want to use two config files and two logstash running so thats why

8

You can use multiple pipelines and each pipeline listens on a different port up specify on the Logstash Input Module

9

This is a much better, and the recommended approach @mangeshs.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.