# Manually checking if confs work properly

**URL:** <https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785>\
**Category:** Logstash\
**Created:** [October 24, 2016, 6:04pm UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785 "2016-10-24T18:04:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\
**Post date:** [October 24, 2016, 6:04pm UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/1 "2016-10-24T18:04:17Z")

</div>

Is there a possible way to check if some new grok rule or filter-mutate works without waiting index rotation?  
We added some new stuff and we wanna check out if the new index will work properly as expected.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 24, 2016, 7:55pm UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/2 "2016-10-24T19:55:53Z")

</div>

Check what, exactly? You may find [Logstash Filter Verifier](https://github.com/magnusbaeck/logstash-filter-verifier) useful.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 24, 2016, 9:33pm UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/3 "2016-10-24T21:33:03Z")

</div>

You don't need to wait for an index to rotate to know if filters work, they are independant.

---

<div class="post-metadata">

**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\
**Post date:** [October 25, 2016, 8:11pm UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/4 "2016-10-25T20:11:58Z")

</div>

Thanks a lot for your replies.I am sorry for my delay to answer but i got stack with personal problems.

@magnusbaeck - What i mean is this.If i make a change on my logstash filters and then add on my output file a new index like this:

//filter:

```
  if "%" in [message]{
 	if [syslog_program] == "charon"{
	mutate{add_tag => ["IPSEC2"]}
}else{
	mutate{add_tag => ["Cisco"]}
}
  }

```

//output :

```
if "IPSEC2" in [tags] {
    elasticsearch {
       hosts => ["localhost:9200"]
       index => "ipsec2-%{+YYYY.MM.dd}"
    }
}

if "Cisco" in [tags] {
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "cisco-%{+YYYY.MM.dd}"
    }
}

```

if i had these 2 inside a single "Cisco-xxxxxx" index that was already working for the day.Will the changes take place and a new index will be created for ipsec2 and split the outputs between the 2 the moment i restart logstash and elastic?Or do i need to wait for the new indeces to be created?

And by checking i mean is there a way to give a single log for input and capture the json that is going to be forwarded to elastic and see the tags,fields etc that are going to be added to it?

PS. I added the filter i commented above and expected the new index to be created and split the outputs.But i still get them on the same index 😕

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 26, 2016, 5:58am UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/5 "2016-10-26T05:58:57Z")

</div>

> Will the changes take place and a new index will be created for ipsec2 and split the outputs between the 2 the moment i restart logstash and elastic?

Yes, but you don't have to restart ES.

> Or do i need to wait for the new indeces to be created?

Indexes are created when they receive data.

> And by checking i mean is there a way to give a single log for input and capture the json that is going to be forwarded to elastic and see the tags,fields etc that are going to be added to it?

You can use a `stdout { codec => rubydebug }` output to verify that events look as you expect them to. Testing the conditionals surrounding outputs is tricky.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785/6 "2017-07-06T04:32:48Z")

</div>

Closed on July 6, 2017, 4:32am UTC