Apologies beforehand for the dilettante question.
I have an up and running Logstash configuration. Now and then I edit my grok parser and then I always have to type
systemctl restart logstash so that the latest config is applied (I guess I'm losing logs until the pipe is back online).
I already read this this article.
However, for some reason this is still clear as mud to me.
So my questions are as follows:
- If I simply change the
Truedoes that mean that after the changes I do to the grok filter the config will be auto reload on its own (depending on the interval I'm checking for any new stuff)?
- And another question, whilst the pipeline is reloading (no mater automatic or me doing it manually) I'm loosing logs I am not? And if yes what can I do, Persistent queue maybe (but currently the logs are coming via UDP, although a friend told me to get them via TCP and encrypted)? To my understanding if the logs are coming from Syslog via UDP PQ is not a viable option?