# Logstash variables in the output plugin for ADX/Log Analytics in Azure

**URL:** <https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461>\
**Category:** Logstash\
**Created:** [January 4, 2023, 12:37pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461 "2023-01-04T12:37:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [January 4, 2023, 12:37pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/1 "2023-01-04T12:37:29Z")

</div>

Hello All, I have a question.

I have a Logstash configuration with an output plugin for Log Analytics/Azure Data explorer in Azure.  
In my configuration (the output plugin part) instead of using the workspace ID and key or app id, key and tenant I use variables in the form of

```auto
app_id => "${W_APP_ID}"
app_key => "${W_APP_KEY}"
app_tenant => "${W_APP_TENANT}"
w_id => "${W_ID}"
w_key => "${W_KEY}"

```

Then I put the real values under `/etc/defaults/logstash` file on my Unix server in the format of

```auto
w-ID="value-goes-here"

```

Then my configuration is working perfectly but sometimes after an `apt get update/upgrade` those entries in `/etc/defaults/logstash` disappear (no idea why) but what is stranger is that my Logstash configuration still work as a charm.

Do you know why and if Logstash is storing them somewhere else?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 4, 2023, 1:25pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/2 "2023-01-04T13:25:17Z")

</div>

> [@stillfreem](#):
>
> Do you know why and if Logstash is storing them somewhere else?

Logstash loads the values from the file into memory when it started, if you didn't restarted Logstash after the last time it succesfully loaded those files, then it will keep working.

If you remove the file or the variables from the file and restart Logstash, it will not work, unless you have the same variables in the logstash user environment.

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [January 4, 2023, 1:36pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/3 "2023-01-04T13:36:56Z")

</div>

Thank you very much @leandrojmp and do you know why the entries are being deleted after an update of the system, not always but sometimes, can I somehow prevent this?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 4, 2023, 6:04pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/4 "2023-01-04T18:04:10Z")

</div>

> [@stillfreem](#):
>
> you know why the entries are being deleted after an update of the system, not always but sometimes, can I somehow prevent this?

No idea, this should not happen when you update Logstash, it is something in your system that is deleting the file, you need to troubleshoot in your system what can be the cause.

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [January 5, 2023, 12:04pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/5 "2023-01-05T12:04:26Z")

</div>

thank you for responding.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2023, 12:04pm UTC](https://discuss.elastic.co/t/logstash-variables-in-the-output-plugin-for-adx-log-analytics-in-azure/322461/6 "2023-02-02T12:04:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.