# Logstash service multiple configs

**URL:** <https://discuss.elastic.co/t/logstash-service-multiple-configs/86923>\
**Category:** Logstash\
**Created:** [May 24, 2017, 8:54am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923 "2017-05-24T08:54:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjjuurrbbbb](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jjjuurrbbbb](https://discuss.elastic.co/u/jjjuurrbbbb)\
**Post date:** [May 24, 2017, 8:54am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/1 "2017-05-24T08:54:24Z")

</div>

Hi,

Just getting started with Logstash and am trying to get the service started using multiple config files on CentOS.

My logstash.service configuration is as follows:

[Unit]  
Description=logstash

[Service]  
Type=simple  
User=logstash  
Group=logstash

# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.

# Prefixing the path with '-' makes it try to load, but if the file doesn't

# exist, it continues onward.

EnvironmentFile=-/etc/default/logstash  
EnvironmentFile=-/etc/sysconfig/logstash  
ExecStart=/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/  
Restart=always  
WorkingDirectory=/  
Nice=19  
LimitNOFILE=16384

My logstash user has permission to the /etc/logstash/conf.d directory. If I append the line:

ExecStart=/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/

with the name of a config the service starts with that config.

Is it possible to pass the directory name into the service config and have Logstash parse all the configs or does all configuration need to be in one config. I've not been able to get a clear answer on this Googling.

Thanks

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [May 24, 2017, 9:53am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/2 "2017-05-24T09:53:17Z")

</div>

You can pass a directory as a config path indeed. Logstash will concatenate and sort (inputs-\>filters-\>outputs) all files found inside.  
This means though that only properly formatted config files have to be inside the directory, any other files will make Logstash throw an error.

---

<div class="post-metadata">

**Author:** ![jjjuurrbbbb](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jjjuurrbbbb](https://discuss.elastic.co/u/jjjuurrbbbb)\
**Post date:** [May 24, 2017, 10:18am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/3 "2017-05-24T10:18:22Z")

</div>

Thanks but that doesn't fully answer my query. I believe I've configured the service correctly (i.e. the line "ExecStart=/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/" ) but it doesn't pick up the configs in the directory. If I pass the full path directing it to a config it works ok.

Any ideas what I'm doing wrong?

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 24, 2017, 11:06am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/4 "2017-05-24T11:06:48Z")

</div>

What about: `"ExecStart=/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/*.conf"`

---

<div class="post-metadata">

**Author:** ![jjjuurrbbbb](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jjjuurrbbbb](https://discuss.elastic.co/u/jjjuurrbbbb)\
**Post date:** [May 24, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/5 "2017-05-24T11:11:15Z")

</div>

That's got it! Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-service-multiple-configs/86923/6 "2017-06-21T11:11:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
