New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« exec ganglia »
Elastic Docs ›Logstash Reference [5.0] ›Output plugins

file

edit

file

edit

This output writes events to files on disk. You can use fields from the event as parts of the filename and/or path.

By default, this output writes one event per line in json format. You can customise the line format using the line codec like

output {
 file {
   path => ...
   codec => line { format => "custom format: %{message}"}
 }
}

 

Synopsis

edit

This plugin supports the following configuration options:

Required configuration options:

file {
    path => ...
}

Available configuration options:

Setting Input type Required Default value

codec

codec

No

"json_lines"

create_if_deleted

boolean

No

true

dir_mode

number

No

-1

file_mode

number

No

-1

filename_failure

string

No

"_filepath_failures"

flush_interval

number

No

2

gzip

boolean

No

false

path

string

Yes

workers

number

No

1

Details

edit

 

codec

edit
  • Value type is codec
  • Default value is "json_lines"

The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.

create_if_deleted

edit
  • Value type is boolean
  • Default value is true

If the a file is deleted, but an event is comming with the need to be stored in such a file, the plugin will created a gain this file. Default ⇒ true

dir_mode

edit
  • Value type is number
  • Default value is -1

Dir access mode to use. Note that due to the bug in jruby system umask is ignored on linux: https://github.com/jruby/jruby/issues/3426 Setting it to -1 uses default OS value. Example: "dir_mode" => 0750

file_mode

edit
  • Value type is number
  • Default value is -1

File access mode to use. Note that due to the bug in jruby system umask is ignored on linux: https://github.com/jruby/jruby/issues/3426 Setting it to -1 uses default OS value. Example: "file_mode" => 0640

filename_failure

edit
  • Value type is string
  • Default value is "_filepath_failures"

If the generated path is invalid, the events will be saved into this file and inside the defined path.

flush_interval

edit
  • Value type is number
  • Default value is 2

Flush interval (in seconds) for flushing writes to log files. 0 will flush on every message.

gzip

edit
  • Value type is boolean
  • Default value is false

Gzip the output stream before writing to disk.

message_format (DEPRECATED)

edit
  • DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
  • Value type is string
  • There is no default value for this setting.

The format to use when writing events to the file. This value supports any string and can include %{name} and other dynamic strings.

If this setting is omitted, the full json representation of the event will be written as a single line.

path

edit
  • This is a required setting.
  • Value type is string
  • There is no default value for this setting.

The path to the file to write. Event fields can be used here, like /var/log/logstash/%{host}/%{application} One may also utilize the path option for date-based log rotation via the joda time format. This will use the event timestamp. E.g.: path => "./test-%{+YYYY-MM-dd}.txt" to create ./test-2013-05-29.txt

If you use an absolute path you cannot start with a dynamic string. E.g: /%{myfield}/, /test-%{myfield}/ are not valid paths

workers

edit
  • Value type is number
  • Default value is 1

The number of workers to use for this output. Note that this setting may not be useful for all outputs.

« exec ganglia »