Pipelines.yml and best practices using this approach (+auto config reload)

Elastic Stack Logstash
1

Hello Guys,

I just created several different pipelines and I'm running them using pipelines.yml and systemctl command to control logstash service. I have a few questions regarding this approach, I hope you can answer them:

  1. systemctl stop logstash.service stops all pipelines defined in the pipielines.yml. Is it possible to stop single pipeline using this approach?
  2. Is it possible to automaticaly relog a config of one particular pipeline (similar to config.reload.automatic)?
  3. What is the best practice for an architecture focused around different pipelines? I plan to have a few jdbc and flat files pipelines and I'm looking for best approach to do so. As for now, using pipelines.yml seems to be an obvious choice.

Thanks in advance.

2

For 2 ... yes, if you enable -r then if you update the configuration of a single pipeline it will get reloaded.

3

I launched logstash service using below command

sudo systemctl start logstash.service -r

and it seems like my configuration changes have no effect. The pipieline continues to work with initial settings.

4

Run

sudo systemctl show logstash

It should include a line like

FragmentPath=/etc/systemd/system/logstash.service

Edit that file and change the ExecStart line to include -r.

5

This is great, thank you!