IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Reloading the Config File Managing Multiline Events »

› ›

Command-line flags

edit

Command-line flags

edit

Logstash has the following flags. You can use the --help flag to display this information.

-f, --config CONFIG_PATH: Load the Logstash config from a specific file or directory. If a directory is given, all files in that directory will be concatenated in lexicographical order and then parsed as a single config file. You can also specify wildcards (globs) and any matched files will be loaded in the order described above.
-e CONFIG_STRING: Use the given string as the configuration data. Same syntax as the config file. If no input is specified, then the following is used as the default input: input { stdin { type => stdin } } and if no output is specified, then the following is used as the default output: output { stdout { codec => rubydebug } }. If you wish to use both defaults, please use the empty string for the -e flag. The default is "".
-w, --pipeline-workers COUNT: Sets the number of pipeline workers to run. The default is 8.
-b, --pipeline-batch-size SIZE: Size of batches the pipeline is to work in. The default is 125. This parameter defines the maximum number of events an individual worker thread will collect before attempting to execute its filters and outputs. Larger batch sizes are generally more efficient, but come at the cost of increased memory overhead. You may have to increase the JVM heap size by setting the LS_HEAP_SIZE variable to effectively use the option.
-u, --pipeline-batch-delay DELAY_IN_MS: When creating pipeline event batches, how long to wait while polling for the next event. The default is 5ms.
-w, --filterworkers COUNT: DEPRECATED. Now an alias for --pipeline-workers and -w.
-l, --log FILE: Write Logstash internal logs to the given file. Without this flag, Logstash will emit logs to standard output.
-v: DEPRECATED. Increase verbosity of Logstash internal logs. Specifying once will show informational logs. Specifying twice will show debug logs. This flag is deprecated. You should use --verbose or --debug instead.
--quiet: Quieter Logstash logging. This causes only errors to be emitted.
--verbose: More verbose logging. This causes info level logs to be emitted.
--debug: Most verbose logging. This causes debug level logs to be emitted.
--debug-config: Print the compiled config ruby code out as a debug log (you must also have --debug enabled). WARNING: This will include any password options passed to plugin configs as plaintext, and may result in plaintext passwords appearing in your logs! The default is false.
-V, --version: Emit the version of Logstash and its friends, then exit.
-p, --pluginpath PATH: A path of where to find plugins. This flag can be given multiple times to include multiple paths. Plugins are expected to be in a specific directory hierarchy: PATH/logstash/TYPE/NAME.rb where TYPE is inputs, filters, outputs, or codecs and NAME is the name of the plugin.
-t, --configtest: Check configuration for valid syntax and then exit. Note that grok patterns are not checked for correctness with this flag. Logstash can read multiple config files from a directory. If you combine this flag with --debug, Logstash will log the combined config file, annotating the individual config blocks with the source file it came from.
--[no-]allow-unsafe-shutdown: Force Logstash to exit during shutdown even if there are still inflight events in memory. By default, Logstash will refuse to quit until all received events have been pushed to the outputs. The default is false.
-r, --[no-]auto-reload: Monitor configuration changes and reload whenever the configuration is changed. NOTE: Use SIGHUP to manually reload the config The default is false.
--reload-interval RELOAD_INTERVAL: How frequently to poll the configuration location for changes, in seconds. The default is 3 seconds.
--allow-env: [preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Enables templating of environment variable values. Instances of ${VAR} in strings will be replaced with the respective environment variable value named "VAR". The default is false.
--[no-]log-in-json: Specify that Logstash should write its own logs in JSON form - one event per line. If false, Logstash will log using Ruby’s Object#inspect (not easy to machine-parse). The default is false.
-h, --help: Print help

« Reloading the Config File Managing Multiline Events »