Logstash variables in the output plugin for ADX/Log Analytics in Azure

Elastic Stack Logstash
1

Hello All, I have a question.

I have a Logstash configuration with an output plugin for Log Analytics/Azure Data explorer in Azure.
In my configuration (the output plugin part) instead of using the workspace ID and key or app id, key and tenant I use variables in the form of

app_id => "${W_APP_ID}"
app_key => "${W_APP_KEY}"
app_tenant => "${W_APP_TENANT}"
w_id => "${W_ID}"
w_key => "${W_KEY}"

Then I put the real values under /etc/defaults/logstash file on my Unix server in the format of

w-ID="value-goes-here"

Then my configuration is working perfectly but sometimes after an apt get update/upgrade those entries in /etc/defaults/logstash disappear (no idea why) but what is stranger is that my Logstash configuration still work as a charm.

Do you know why and if Logstash is storing them somewhere else?

2

Logstash loads the values from the file into memory when it started, if you didn't restarted Logstash after the last time it succesfully loaded those files, then it will keep working.

If you remove the file or the variables from the file and restart Logstash, it will not work, unless you have the same variables in the logstash user environment.

1 Like
3

Thank you very much @leandrojmp and do you know why the entries are being deleted after an update of the system, not always but sometimes, can I somehow prevent this?

4

No idea, this should not happen when you update Logstash, it is something in your system that is deleting the file, you need to troubleshoot in your system what can be the cause.

1 Like
5

thank you for responding.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.