Multiple Logstash conf files with the same Index

Elastic Stack Logstash
1

Hello ,

I have created 2 conf files in /etc/logstash/conf.d folder as below
[root@elkstack-01 conf.d]# cat gxmsg.conf
input{
file{
path => "/advdata/tmp/Counters/cnt-gx.msg*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter{
csv{
separator => ";"
columns => ["TIME","PCS/Main:GxCCAIEverDrpdDueToSecPeerSupp","PCS/Main:GxCCAInitialSuccES","PCS/Main:GxCCAInitialSuccSILP","PCS/Main:GxCCATermSuccES","PCS/Main:GxCCATermSuccSILP","PCS/Main:GxCCAUEverDrpdDueToSecPeerSupp","PCS/Main:GxCCAUpdateSuccES","PCS/Main:GxCCAUpdateSuccSILP","PCS/Main:GxCCRTReqRejES","PCS/Main:GxCCRTermER","PCS/Main:GxCCRTermRILP","PCS/Main:GxCCRUReqRejES","PCS/Main:GxCCRUpdateER","PCS/Main:GxCCRUpdateRILP","PCS/Main:GxMsgEDropMPT","PCS/Main:GxMsgsES","PCS/Main:GxMsgsSentInLP","PCS/Main:GxPdpActivatesCLP","PCS/Main:GxPdpActivatesEC","PCS/Main:GxRAAFailER","PCS/Main:GxRAAFailRILP","PCS/Main:GxRAASuccER","PCS/Main:GxRAASuccRILP","PCS/Main:GxRAATimeOutER","PCS/Main:GxRAATimeOutRILP","PCS/Main:GxRARDrpdRtryLmtRchd","PCS/Main:GxRARDrpdRtryLmtRchdLP","PCS/Main:GxRARMsgES","PCS/Main:GxRARMsgSILP","PCS/Main:GxReqRejCLP","PCS/Main:GxReqRejEC","PCS/Main:GxUsageLimitExcCLP","PCS/Main:GxUsageLimitExcEC","PCS/Main:InvGxMsgsEverRcvd","PCS/Main:InvGxMsgsRcvdInLP","PCS/Main:OvldGxMsgsEverDropped","PCS/Main:RejNoOvldGxMsgsES","PCS/Main:RejNoOvldGxMsgsSILP","PCS/Main:RejOvldGxMsgsES","PCS/Main:RejOvldGxMsgsSILP","PCS/Main:ValGxMsgsEverRcvd","PCS/Main:ValGxMsgsRcvdInLP"]
}

    mutate{
            remove_field => [ "message" ]
          }
  }

output{
elasticsearch{
hosts => ["localhost:9200"]
codec => json
index => "perf"
user => elastic
password => changeme
}

    stdout{
            codec => json
          }

}
[root@elkstack-01 conf.d]#
[root@elkstack-01 conf.d]# cat gxsession.conf
input{
file{
path => "/advdata/tmp/Counters/cnt-gx.session*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter{
csv{
separator => ";"
columns => ["TIME","PCS/Main:GxBearersCreadInLP","PCS/Main:GxBearersCurrExis","PCS/Main:GxBearersEverCread","PCS/Main:GxDeltdHangCtxts","PCS/Main:GxEmSessCreatInLP","PCS/Main:GxEmSessCurrExis","PCS/Main:GxEmSessDILP","PCS/Main:GxEmSessEverCreated","PCS/Main:GxEmSessEverDrpd","PCS/Main:GxPriRxSesBsdCrtInLP","PCS/Main:GxPriRxSesBsdDrpInLP","PCS/Main:GxPriRxSesBsdEvrCrtd","PCS/Main:GxPriRxSesBsdEvrDrp","PCS/Main:GxPriSessCurrExis","PCS/Main:GxPriSprBsdCrtInLP","PCS/Main:GxPriSprBsdDrpInLP","PCS/Main:GxPriSprBsdEvrCrtd","PCS/Main:GxPriSprBsdEvrDrp","PCS/Main:GxSessCreatInLP","PCS/Main:GxSessCurrExis","PCS/Main:GxSessEverCreated","PCS/Main:GxSessEverReleased"]
}
mutate{
remove_field => [ "message" ]
}
}

output{
elasticsearch{
hosts => ["localhost:9200"]
codec => json
index => "perf"
user => elastic
password => changeme
}

    stdout{
            codec => json
          }

}
[root@elkstack-01 conf.d]#

On starting logstash, i see the index being picked

[root@elkstack-01 conf.d]# curl 'localhost:9200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size

yellow open perf IqAeJUWPRnm19vF8Sb2SSQ 5 1 25920 0 16mb 16mb
[root@elkstack-01 conf.d]#

But on Kibana, using the index, i see it has picked only the columns of gxmsg.conf file and not gxsession.conf
Do i need to change any configuration for the same for all the conf file to be read ? how do i start to debug here

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.