I have a Logstash configuration with an output plugin for Log Analytics/Azure Data explorer in Azure.
In my configuration (the output plugin part) instead of using the workspace ID and key or app id, key and tenant I use variables in the form of
Then I put the real values under /etc/defaults/logstash file on my Unix server in the format of
Then my configuration is working perfectly but sometimes after an apt get update/upgrade those entries in /etc/defaults/logstash disappear (no idea why) but what is stranger is that my Logstash configuration still work as a charm.
Do you know why and if Logstash is storing them somewhere else?