Logstash multiple configuration files

Elastic Stack Logstash
1

Hi everybody,

Do you think it is possible to have several configuration for logstash filters files and load only one according to the filebeat agent version ?
Thanks a lot for your help.

BR,
Khaled

2

Filebeat adds a [beat][version] field to events. You could make your processing conditional upon that.

3

Thank you for the reply.
I know that filebeat sends its version so that it is possible to have a conditional processing.
By convenience, i don't want to have my implementation in the same file.
So, is it possible to have filter_1.conf (for filebeat version 1) and filter_2.conf (for filebeat version 2) included in filter_conf and make something like this :

filter {
    if [version] == 1 {
        process(filter_1.conf)
    }
    else {
        process(filter_2.conf)
    }
}

BR,

Khaled

4

If you start logstash with "-f /some/directory/" then it will concatenate all of the files in that directory (all of them, including files called things like logstash.conf.backup) and use that as the configuration. So you can have two files. One that has

filter {
    if [beat][version] == "some version" {
         processing for that version
    }
}

and a second file that has

filter {
    if [beat][version] == "some other version" {
         processing for that version
    }
}
5

Badger,

You're the Boss !
Thanks a lot for your help.

BR,
Khaled

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.