Stopping LogStash after processing the data

Elastic Stack Logstash
1

Hello:

I am creating my own conf file that I supply on command line to LogStash - it works like a charm, however it does not stop after processing all the data. I do not expect to generate new files in some folder, nor need to run the LogStash as a daemon. How can I instruct LogStash to stop after processing the whole file?

This is the video I followed: https://www.youtube.com/watch?v=rKy4sFbIZ3U&t=958s

This is my config:

input {
  file {
    path => "/home/romankagan/practice-1562x.csv"
    start_position => "beginning"
    sincedb_path => "NULL"
  }
}
filter {
      csv {
        columns => [ "authorName","createdDate","dateOfService","deleted","documentName","draft","id","ownerUserId","patientId","practice","sections","text" ]
     }
     mutate{convert => ["ownerUserId","integer"]}
     mutate{convert => ["patientId","integer"]}
     mutate{convert => ["draft","boolean"]}
     mutate{convert => ["id","integer"]}
     mutate{convert => ["practice","integer"]}
     mutate{convert => ["deleted","boolean"]}
     mutate{remove_field => ["message"]}
     date {
        match => [ "createdDate", "yyyy-MM-dd HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss","MMM dd yyyy HH:mm:ss",
              "MMM  d yyyy HH:mm:ss", "ISO8601" ]
      }
      date {
        match => [ "dateOfService", "yyyy-MM-dd HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss","MMM dd yyyy HH:mm:ss",
              "MMM  d yyyy HH:mm:ss", "ISO8601" ]
      }
    }
output {
  elasticsearch { 
  hosts => ["localhost:9200"] 
  index => "practice-1562xx"
  }
  stdout { codec => rubydebug }
 }

This is how I start the logstash:

bin/logstash -f logstash-simple.conf
2

You will need to use cat + stdin to do this, there's no way to do it with the config you have.

1 Like
3

Could you please give an example of such command?

4

Something like

cat /path/to/file | logstash -e '{input { stdin {} }'
2 Likes
5

Thank you soooooo much. It works like a charm!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.