To give input to ELasticsearch via logstash


(trusha) #1

I m having txt file (size 4 GB ) with json string as below ,

eg:
{"index":{"_id": "178790318"}}
{"Id":"178790318","Description":"Kynoch Rd, Durban City, Durban, KwaZulu-Natal, South Africa","Odometer":"578676","Ignition":"ON","Location":{"lat":"-30.0178","lon":"30.9065"},"Reg":"ND343265","Speed":"9","Time":"2014-06-08T00:07:29.000"}

i want to send this input file to Elasticsearch using Logstash.
this is formated input which i used to give while bulk insert in Elasticsearch,
but as the data size is big, It is not reliable to send records through bulk API( here I m using Postman as web service to send and recieve request)
Is possible to send this file via Logstash in one attempt? if yes what should be the logstash.conf file?


(Mark Walkom) #2

A 4GB bulk is too large, you should really make it smaller.

But no, you can't do this with LS.


(Magnus Bäck) #3

Not sure what you mean by "one attempt". Does the file contain a single 4 GB JSON object? Or multiple objects? If if it contains multiple objects, why would you need to use a single bulk request?


(trusha) #4

File contain multiple JSON object (near about 1.6 crores). I want to import all these objects which are there in single RTP file at a time using Logstash. Before I used to send some 3 lakh objects in single bulk request at a time, but it is not feasible to send these files one after the other(as is want to perform search on whole 1.6 crore obj ), this consumes time. Hence is wanted to know if logstash could help to import large file to Elasticsearch, so that we could skip bulk insert for each 3 lakh obj( 50 files).


(Magnus Bäck) #5

but it is not feasible to send these files one after the other(as is want to perform search on whole 1.6 crore obj ), this consumes time.

I don't understand this sentence.

Hence is wanted to know if logstash could help to import large file to Elasticsearch, so that we could skip bulk insert for each 3 lakh obj( 50 files).

Logstash can certainly import the file for you, but it's going to take multiple bulk requests. It seems you perceive that as a problem but I don't understand why.

(Very few people outside India and neighboring countries understand "crore" and "lakh". To avoid confusion I suggest you use other words.)


(system) #6