i have the same problem please kindly help me, here are my scenarios
i currently learning using logstash and beat, and my first lesson is ingesting csv file using filebeat to logstash and visualize it with kibana on elasticsearch. It works, the config file i use is logstash.conf
now i try to ingesting file with grok filter, on the same config file by editing the previous config file that i use to ingesting csv file. and this problem appears.
questions are :
how do logstash pipeline works? I mean i've deleted the previous config and according to the error it seems there is still a running pipeline?
how to fix this error.
please kindly help me with my silly questions. thank you so much
actually it would be good if you open another thread.
but pipeline is something if you want to run config all the time with schedule
command line something if you want to test it.
you have not got the funda down yet.
when you start the logstash daemon, it reads the /etc/logstash/pipeline.yml file and runs all the config listed under that pileline file. and it keeps running. basically it is logstash daemon stays in memory and runs it with all the parameter you have in pipeline.yml file
if you have that daemon running that means you won't be able to run another logstash command on same machine.
once you run logstash daemon it reads all the config and all the setting and puts it in memory. that means after starting daemon if you change your config file it will not take effect of your changes. you have to restart your daemon.
There is a option in logstash.yml which let you do it. but I have not try it
im sorry but i thought i have the pretty same problem which showing the same error. so how do we restart the daemon?
and is the daemon still running even if i run another config with -f flag? i mean i ever run logstash.conf and it successfully sending log to my elastic, then i want to send different log so i edit the whole logstash.conf file, then run it with -f flag.
thank you for the responds.
mutate processes operations in a fixed order. strip comes before add_field, so when it tries to do the strip the fields do not exist, so strip is a no-op. split them each into two mutate filters.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.