Logstash priority order when using multiple config files

Elastic Stack Logstash
1

Hi All

I'm planning to use multiple config files in our deployment.

  • One config file with input for beat and output to elastic search only
  • I would like to maintain separate config file for each applications teams for data filtering .. so that any changes requested by any team we shall make changes only to the respective team config file maintained. This way we shall avoid impacting other team data streaming while changing for one team.

My question here is/are:

  • is there any priority order applied by logstash when it reads all config files from config dir? ..like chronological?
2

The file order is alphabetical, so depending whether the filters are depended on each other or not, you can prefix/suffix the file names to maintain appropriate order.

3

Thanks. Which config takes the priority? the found or last found config if the same config is placed in multiple configs by mistake ..

4

The configs are concatenated in alphabetical order, so no config takes priority over another, which is why it is important to use conditionals to ensure you e.g. do not send all events to all elastic search outputs (if more than one is configured).