I have multiple configuration files for Logstash, each file contains inputs, filters & outputs.
Is this the recommended method or should I have separate files containing only 1 of the above?
For example: 1-input.conf, 2-input, 3-input, 4-filter.conf, 5-filter.conf etc.
I'm just unsure of the order in which Logstash processes these files and cannot find anything clarification in the documentation..
1 Like
@Gromit - I tend to group similar filters and such into individual conf files. I use numbering along with names to ensure on the loading order. Ensuring that my inputs load first, filters (in order of dependency) and then outputs. You can see an example of what I am talking about at my GitHub repo.
https://github.com/mrlesmithjr/Ansible/tree/master/roles/elk-processor/templates/etc/logstash/conf.d
1 Like
Exactly the information I was looking for, thanks very much.
Absolutely!
I'm just unsure of the order in which Logstash processes these files and cannot find anything clarification in the documentation..
The command-line documentation notes that when given a directory Logstash loads the files in alphabetical order. Ordering only matters for filters, and how you split the configuration stanzas between files doesn't matter.