file
editfile
editThis output writes events to files on disk. You can use fields from the event as parts of the filename and/or path.
By default, this output writes one event per line in json format.
You can customise the line format using the line
codec like
output { file { path => ... codec => line { format => "custom format: %{message}"} } }
Synopsis
editThis plugin supports the following configuration options:
Required configuration options:
file { path => ... }
Available configuration options:
Details
edit
codec
edit- Value type is codec
-
Default value is
"json_lines"
The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.
create_if_deleted
edit- Value type is boolean
-
Default value is
true
If the a file is deleted, but an event is comming with the need to be stored in such a file, the plugin will created a gain this file. Default ⇒ true
dir_mode
edit- Value type is number
-
Default value is
-1
Dir access mode to use. Note that due to the bug in jruby system umask
is ignored on linux: https://github.com/jruby/jruby/issues/3426
Setting it to -1 uses default OS value.
Example: "dir_mode" => 0750
file_mode
edit- Value type is number
-
Default value is
-1
File access mode to use. Note that due to the bug in jruby system umask
is ignored on linux: https://github.com/jruby/jruby/issues/3426
Setting it to -1 uses default OS value.
Example: "file_mode" => 0640
filename_failure
edit- Value type is string
-
Default value is
"_filepath_failures"
If the generated path is invalid, the events will be saved into this file and inside the defined path.
flush_interval
edit- Value type is number
-
Default value is
2
Flush interval (in seconds) for flushing writes to log files. 0 will flush on every message.
gzip
edit- Value type is boolean
-
Default value is
false
Gzip the output stream before writing to disk.
message_format
(DEPRECATED)
edit- DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
- Value type is string
- There is no default value for this setting.
The format to use when writing events to the file. This value
supports any string and can include %{name}
and other dynamic
strings.
If this setting is omitted, the full json representation of the event will be written as a single line.
path
edit- This is a required setting.
- Value type is string
- There is no default value for this setting.
The path to the file to write. Event fields can be used here,
like /var/log/logstash/%{host}/%{application}
One may also utilize the path option for date-based log
rotation via the joda time format. This will use the event
timestamp.
E.g.: path => "./test-%{+YYYY-MM-dd}.txt"
to create
./test-2013-05-29.txt
If you use an absolute path you cannot start with a dynamic string.
E.g: /%{myfield}/
, /test-%{myfield}/
are not valid paths