Testing filebeat+logstash

Elastic Stack Beats
1

Is there a way to have filebeat exit once it reaches end-of-file for all prospectors? The use case I'm trying to support is to launch filebeat with a known set of payloads, send to a test instance of logstash, and then compare the logstash results - an integration test for our logstash configuration.

I suppose I could spawn the filebeat process in the background and kill it once I see "no events to publish" in its output, but I was hoping for something a bit simpler & more robust.

Or, I'm open to suggestions on how else to automatically test our logstash configuration.

Thank you,
Erik Stephens

2

Hi @erikstephens

Currently this is not possible. We were thinking of implementing something like this for our own system and integration test cases. The idea was to have a flag on startup that every harvester is only started once and runs until no new lines are found. Do get this implemented some refactoring of the prospector and harvester are needed.

Feel free to open an issue for it in the filebeat repo: https://github.com/elastic/filebeat

3

Ok, thx. Issue here: https://github.com/elastic/filebeat/issues/134