Using global variables or reading values from a file

Elastic Stack Logstash
1

Hello everybody!. I was wondering if there's a way to either define global variables that I can use from the output.conf file or read them from a given file.

My scenario is the following, in 201-output.conf file I have the following code:

output {
    if "_grokparsefailure" in [tags] {
        elasticsearch {
            hosts => "..."
            ssl => true
            user => "..."
            password => "..."
            index => "failure_logs"
        }
    }
   ....
}

I would like to read the hosts, user and password fields from a file and inject them there.
I know there's a technology called Logstash Keystore, but as far as I have researched it cannot be automated, you need to manually enter on each machine where Logstash is installed and set the variables that you need to use later on.

Is there a way to accomplish this using a ruby filter?

Thank you all!

2

It is possible to use variables from your environment:

output {
    if "_grokparsefailure" in [tags] {
        elasticsearch {
            hosts => "${LS_OUTPUT_ES_HOST}"
            ssl => true
            user => "${LS_OUTPUT_ES_USERNAME}"
            password => "${LS_OUTPUT_ES_USERNAME}"
            index => "failure_logs"
        }
    }
    # ....
}

It should then be possible to define and export these variables in a shell script:

export LS_OUTPUT_ES_HOST='123.45.67.89'
export LS_OUTPUT_ES_USER='sekret_user'
export LS_OUTPUT_ES_PASSWORD='$up3r$ekr3t'

And, depending on how you start Logstash (e.g., command-line or via a service manager like upstart or initd), adding the following before launching Logstash:

source path/to/logstash.environment
1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.