What would be the best way of gracefully shutting down Logstash based on a message pattern match? The pattern match would indicate the file input stream is dead.
if ([message] =~ "patternA") {
ruby{
code => "some shutdown code"
}
}
Our Desired Scenario:
An automated job runs performance tests that use Logstash to ship results to Elasticsearch. Each job requires a test run specific Logstash configuration and multiple jobs can run simultaneously on a server. Each Logstash instance lives only within the job and must live long enough to complete shipping of the results file.
The automated job implements the following steps
-
An instance of Logstash is configured for the test and started to monitor the soon to exist performance test result file. -
The test is started and results are being generated. A test run can take a couple of minutes or up to a couple of hours -
Logstash starts reading the results stream and shipping to Elasticsearch -
The test completes -
The job appends a message, containing patternA, to the results file. -
Logstash continues reading and shipping -
Logstash reads the message containing patternA and starts graceful shutdown, allowing buffered data to ship -
Logstash completes shipping and then terminates -
Job verifies Logstash termination and completes