Why logstash shut down when I use output to log.txt?

Elastic Stack Logstash
1

I have a log index "log_index_0701" and there is about 9000000 logs in this index.

I want to output this index log as a txt file but logstash always shut down when I output.

Here is my config

input{
   elasticsearch{
      hosts => ["localhost:9200"]
      index => "log_index_0701"
}
}

output{
    file{
     path=>"/etc/logstash/0701.txt"
     codec => line {format => "custom format : %{message}"}
}
}

And this is shut down message

 /usr/share/logstash/bin/logstash -f etc/logstash/conf.d/es_file.conf

[INFO ] 2021-07-05 19:33:59.593 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9601}
[INFO ] 2021-07-05 19:33:59.916 [[main]>worker0] file - Opening file {:path=>"/etc/logstash/0701.txt"}
[INFO ] 2021-07-05 19:49:12.387 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}
[INFO ] 2021-07-05 19:49:12.561 [LogStash::Runner] runner - Logstash shut down.

How can I solve this problem?
Thank you

2

You need to supply a query to elasticsearch in your input otherwise it will just run:

'{ "sort": [ "_doc" ] }'

Logstash shuts down because you do not have a set schedule and as far as it is concerned it is done doing what it needs to do.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.