Passing Multiple Arguments while Logstash startup

Elastic Stack Logstash
1

I have more than 5 logstash conf files. I need to start all the conf files all together. How can I pass all the files names together ?

logstash -f Logstash-ES1.conf
logstash -f Logstash-ES2.conf
logstash -f Logstash-ES3.conf

Command Line which I tried and it didnt work -

logstash -f Logstash-ES1.conf Logstash-ES2.conf Logstash-ES3.conf

2

Should work:

logstash -f file1.conf -f file2.conf ... -f fileN.conf

Also works IIRC:

logstash -f "*.conf"
3

[quote="magnusbaeck, post:2, topic:47805"]
logstash -f file1.conf -f file2.conf ... -f fileN.conf
[/quote] It is only picking the last file event. i.e. fileN.conf event is captured but file.1conf is not.

[quote="magnusbaeck, post:2, topic:47805"]
logstash -f "*.conf"
[/quote]It is not capturing anything.

4

If you start Logstash with the --debug option it'll show you exactly what configuration it loads.

By the way, you know that you can pass a directory name to -f? Then LS will load all files in that directory.

5

Can you give me a sample command line for passing in the entire directory name?

Suppose I have a folder named "LgConf" under the bin folder.
logstash -f "LgConf" -> Is this correct ?

6

I wouldn't make any assumptions about Logstash's behavior when passing a relative path but passing an absolute path certainly works.

7

I tried passing the entire path. The syntax worked but it is also capturing only 1 conf. The first conf event is getting captured but the rest are not.

The same result as above command lines.

8

If events aren't being captured that could be caused by many other things. As I said, with the --debug option you can find out exactly which configuration Logstash loads so that you can focus your debugging efforts in the right place.

9

When I execute those conf file individually it works fine. The only prob is while running multiple conf files altogether.

I have enabled the --debug command. But I am unable to triage it because the output keeps on showing Flushing buffer, hence unable to debug it.

Any suggestions, what should I be doing here ?

10

I have enabled the --debug command. But I am unable to triage it because the output keeps on showing Flushing buffer, hence unable to debug it.

Redirect the output to a file and read that file.

11

Pasted image644×607 14.2 KB

Pasted image780×177 25.7 KB

Tried all of the above...looks like logstash is not able to pull multiple conf's.

Saw threads here -
https://groups.google.com/forum/#!msg/elasticsearch/vFIuBage0tE/vNc-HyvZM1sJ
https://groups.google.com/forum/#!msg/logstash-users/eNYmpFueHtM/cx1NjAx1SOQJ

12

Might be a Windows-specific bug.

13

I was trying this on Windows 7. Will try this on Windows Server 2012 R2.

Will let you know the outcome.

14

Getting this error on Win 2012 R2 machine.

D:\Elastic\Logstash-2.3.1\bin>logstash -f "D:/Elastic/Logstash-2.3.1/bin/AppTier
Conf/*.conf" --configtest
io/console not supported; tty will not be manipulated
←[33mAn unexpected error occurred! {:error=>#<RuntimeError: translation missing:
en.logstash.runner.configuration.scheme-not-supported>, :class=>"RuntimeError",
:backtrace=>["D:/Elastic/Logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-c
ore-2.3.1-java/lib/logstash/config/loader.rb:43:in load_config'", "D:/Elastic/L ogstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash /config/loader.rb:17:informat_config'", "D:/Elastic/Logstash-2.3.1/vendor/bund
le/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/agent.rb:181:in execute '", "D:/Elastic/Logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1- java/lib/logstash/runner.rb:94:inrun'", "org/jruby/RubyProc.java:281:in call' ", "D:/Elastic/Logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-j ava/lib/logstash/runner.rb:99:inrun'", "org/jruby/RubyProc.java:281:in call'" , "D:/Elastic/Logstash-2.3.1/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/t ask.rb:24:ininitialize'"], :level=>:warn}←[0m

15

Making sure you run logstash.bat instead of the logstash binary, run it like this in powershell:

.\logstash\bin\logstash.bat -f .\multiconffolder

Where you don't specify the file glob pattern, just the folder :sunglasses: