Modules and pipelines - Ignoring the 'pipelines.yml'

[collse]

Hi,

still trying to get a grip on this but I want to use the netflow plugin of logstash but surely at the same time not sacrifice my other configuration but I cant find any information if this is even possible or how this should be done.

when I restart logstash I receive the following error: Ignoring the 'pipelines.yml' file because modules or command line options are specified - which obviously ignores all my .conf files and stops that ingestion.

I couldnt find any information how else to run the module but from within the logstash.conf - so with the lack of further information on this I am chasing my own tail here ..

I would think that both is somehow possible I just cannot find the right documentation pointing me towards it.

any suggestion or clarification on this would be highly appreciated.

[collse]

ok I figured it out myself ....

what I did, in case anyone else might come up with this is, I had a look at the logs and found the configuration as its being shipped, copied it to my logstash/conf.d directory and removed all variables and added absolute paths ... works and keeps the previous configuration, index, dashboards that were installed by the plugin ...

so: cp /usr/share/logstash/modules/netflow/configuration/logstash/netflow.conf.erb /etc/logstash/conf.d/netflow.conf

set the input:

input {
udp {
type => "netflow"
port => 2055
codec => netflow {
versions => [5,9]
}
workers => 2
receive_buffer_bytes => 212992
queue_size => 2000
}
}

set all paths eg:

dictionary_path => "/usr/share/logstash/modules/netflow/configuration/logstash/dictionaries/name.yml"

set the output to the correct, previous index

output {
elasticsearch { hosts => ["localhost:9200"]
index => "netflow-%{+YYYY.MM.dd}" }
stdout { codec => rubydebug }
}