How can I stop the Logstash instance, while ensuring that it finish sending the bulks to Elasticsearch? I don't want to loose any logs while stopping logstash.
My version od ELK is 5.3
My file.conf :
input {
http_poller {
urls => {
test1 => { method => get
url => "https://jira.vermeg.com/rest/api/2/search?"
headers => {
Accept => "application/json"
}}
test2 => { method => get
url=>"https://jira.vermeg.com/rest/api/2/search?"
headers => {
Accept => "application/json"
}}
}
interval => 3600
}}
filter {
split {
field => "issues"
}
mutate {
add_field => {"SvnTrace"=>"not_found"}
add_field => {"key" => "%{issues[key]}"}
}}
filter {
elasticsearch {
hosts => ["10.6.140.58:9200"]
index => "svn.solife-2017.05.15"
query => 'is :" %{[key]}"'
fields => { "revision" => "SvnTrace" }
}}
filter {
if [SvnTrace] != "not_found" {
drop {}
}}
output {
elasticsearch {
hosts => "10.6.140.58:9200"
index => "jira-svn-demo_test10"
}
}