- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Setting Up X-Pack
- Breaking changes
- Upgrading Logstash
- Configuring Logstash
- Data Resiliency
- Working with Filebeat Modules
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Working with plugins
- Input plugins
- Beats input plugin
- Cloudwatch input plugin
- Couchdb_changes input plugin
- Dead_letter_queue input plugin
- Drupal_dblog input plugin
- Elasticsearch input plugin
- Eventlog output plugin
- Exec input plugin
- File input plugin
- Ganglia input plugin
- Gelf input plugin
- Gemfire input plugin
- Generator input plugin
- Github input plugin
- Google_pubsub input plugin
- Graphite input plugin
- Heartbeat input plugin
- heroku input plugin
- Http input plugin
- Http_poller input plugin
- Imap input plugin
- Irc input plugin
- Jdbc input plugin
- Jms input plugin
- Jmx input plugin
- Kafka input plugin
- Kinesis input plugin
- Log4j input plugin
- Lumberjack input plugin
- Meetup input plugin
- Pipe input plugin
- Puppet_facter input plugin
- Rabbitmq input plugin
- rackspace input plugin
- Redis input plugin
- Relp input plugin
- Rss input plugin
- S3 input plugin
- Salesforce input plugin
- Snmptrap input plugin
- Sqlite input plugin
- Sqs input plugin
- Stdin input plugin
- Stomp input plugin
- Syslog input plugin
- Tcp input plugin
- Twitter input plugin
- Udp input plugin
- Unix input plugin
- Varnishlog input plugin
- Websocket input plugin
- Wmi input plugin
- Xmpp input plugin
- Zenoss input plugin
- Zeromq input plugin
- Output plugins
- Boundary output plugin
- Circonus output plugin
- Cloudwatch output plugin
- Csv output plugin
- Datadog output plugin
- Datadog_metrics output plugin
- Elasticsearch output plugin
- Email output plugin
- Exec output plugin
- File output plugin
- Ganglia output plugin
- Gelf output plugin
- Google_bigquery output plugin
- Google_cloud_storage output plugin
- Graphite output plugin
- Graphtastic output plugin
- Hipchat output plugin
- Http output plugin
- Influxdb output plugin
- Irc output plugin
- Jira output plugin
- Jms output plugin
- Juggernaut output plugin
- Kafka output plugin
- Librato output plugin
- Loggly output plugin
- Lumberjack output plugin
- Metriccatcher output plugin
- Mongodb output plugin
- Nagios output plugin
- Nagios_nsca output plugin
- Newrelic output plugin
- Opentsdb output plugin
- Pagerduty output plugin
- Pipe output plugin
- Rabbitmq output plugin
- Rackspace output plugin
- Redis output plugin
- Redmine output plugin
- Riak output plugin
- Riemann output plugin
- S3 output plugin
- Sns output plugin
- Solr_http output plugin
- Sqs output plugin
- Statsd output plugin
- Stdout output plugin
- Stomp output plugin
- Syslog output plugin
- Tcp output plugin
- Udp output plugin
- Webhdfs output plugin
- Websocket output plugin
- Xmpp output plugin
- Zabbix output plugin
- Zeromq output plugin
- Filter plugins
- Aggregate filter plugin
- Alter filter plugin
- Anonymize filter plugin
- Cidr filter plugin
- Cipher filter plugin
- Clone filter plugin
- Collate filter plugin
- Csv filter plugin
- Date filter plugin
- De_dot filter plugin
- Dissect filter plugin
- Dns filter plugin
- Drop filter plugin
- Elapsed filter plugin
- Elasticsearch filter plugin
- Environment filter plugin
- Extractnumbers filter plugin
- Fingerprint filter plugin
- Geoip filter plugin
- Grok filter plugin
- I18n filter plugin
- Jdbc_streaming filter plugin
- Json filter plugin
- Json_encode filter plugin
- Kv filter plugin
- Metaevent filter plugin
- Metricize filter plugin
- Metrics filter plugin
- Mutate filter plugin
- Oui filter plugin
- Prune filter plugin
- Punct filter plugin
- Range filter plugin
- Ruby filter plugin
- Sleep filter plugin
- Split filter plugin
- Syslog_pri filter plugin
- Throttle filter plugin
- Tld filter plugin
- Translate filter plugin
- Truncate filter plugin
- Urldecode filter plugin
- Useragent filter plugin
- Uuid filter plugin
- Xml filter plugin
- Yaml filter plugin
- Zeromq filter plugin
- Codec plugins
- Avro codec plugin
- Cef codec plugin
- Cloudfront codec plugin
- Cloudtrail codec plugin
- Collectd codec plugin
- Compress_spooler codec plugin
- Dots codec plugin
- Edn codec plugin
- Edn_lines codec plugin
- Es_bulk codec plugin
- Fluent codec plugin
- Graphite codec plugin
- Gzip_lines codec plugin
- Json codec plugin
- Json_lines codec plugin
- Line codec plugin
- Msgpack codec plugin
- Multiline codec plugin
- Netflow codec plugin
- Nmap codec plugin
- Oldlogstashjson codec plugin
- Plain codec plugin
- Protobuf codec plugin
- Rubydebug codec plugin
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Glossary of Terms
- Release Notes
Running Logstash from the Command Line
editRunning Logstash from the Command Line
editTo run Logstash from the command line, use the following command:
bin/logstash [options]
Where options
are command-line flags that you can
specify to control Logstash execution. The location of the bin
directory
varies by platform. See Logstash Directory Layout to find the location of bin\logstash
on
your system.
The following example runs Logstash and loads the Logstash config defined in
the mypipeline.conf
file:
bin/logstash -f mypipeline.conf
Any flags that you set at the command line override the corresponding settings in the Logstash settings file, but the settings file itself is not changed. It remains as-is for subsequent Logstash runs.
Specifying command line options is useful when you are testing Logstash. However, in a production environment, we recommend that you use the Logstash settings file to control Logstash execution. Using the settings file makes it easier for you to specify multiple options, and it provides you with a single, versionable file that you can use to start up Logstash consistently for each run.
Command-Line Flags
editLogstash has the following flags. You can use the --help
flag to display this information.
-
--node.name NAME
- Specify the name of this Logstash instance. If no value is given it will default to the current hostname.
-
-f, --path.config CONFIG_PATH
-
Load the Logstash config from a specific file or directory. If a directory is given, all files in that directory will be concatenated in lexicographical order and then parsed as a single config file. Specifying this flag multiple times is not supported. If you specify this flag multiple times, Logstash uses the last occurrence (for example,
-f foo -f bar
is the same as-f bar
).You can specify wildcards (globs) and any matched files will be loaded in the order described above. For example, you can use the wildcard feature to load specific files by name:
bin/logstash --debug -f '/tmp/{one,two,three}'
With this command, Logstash concatenates three config files,
/tmp/one
,/tmp/two
, and/tmp/three
, and parses them into a single config. -
-e, --config.string CONFIG_STRING
-
Use the given string as the configuration data. Same syntax as the config file. If no
input is specified, then the following is used as the default input:
input { stdin { type => stdin } }
and if no output is specified, then the following is used as the default output:output { stdout { codec => rubydebug } }
. If you wish to use both defaults, please use the empty string for the-e
flag. The default is nil. -
-w, --pipeline.workers COUNT
- Sets the number of pipeline workers to run. This option sets the number of workers that will, in parallel, execute the filter and output stages of the pipeline. If you find that events are backing up, or that the CPU is not saturated, consider increasing this number to better utilize machine processing power. The default is the number of the host’s CPU cores.
-
-b, --pipeline.batch.size SIZE
-
Size of batches the pipeline is to work in. This option defines the maximum number of events an
individual worker thread will collect from inputs before attempting to execute its filters and outputs.
The default is 125 events. Larger batch sizes are generally more efficient, but come at the cost of
increased memory overhead. You may have to increase the JVM heap size by setting the
LS_HEAP_SIZE
variable to effectively use the option. -
-u, --pipeline.batch.delay DELAY_IN_MS
- When creating pipeline batches, how long to wait while polling for the next event. This option defines how long in milliseconds to wait while polling for the next event before dispatching an undersized batch to filters and workers. The default is 250ms.
-
--pipeline.unsafe_shutdown
- Force Logstash to exit during shutdown even if there are still inflight events in memory. By default, Logstash will refuse to quit until all received events have been pushed to the outputs. Enabling this option can lead to data loss during shutdown.
-
--path.data PATH
-
This should point to a writable directory. Logstash will use this directory whenever it needs to store
data. Plugins will also have access to this path. The default is the
data
directory under Logstash home. -
-p, --path.plugins PATH
-
A path of where to find custom plugins. This flag can be given multiple times to include
multiple paths. Plugins are expected to be in a specific directory hierarchy:
PATH/logstash/TYPE/NAME.rb
whereTYPE
isinputs
,filters
,outputs
, orcodecs
, andNAME
is the name of the plugin. -
-l, --path.logs PATH
- Directory to write Logstash internal logs to.
-
--log.level LEVEL
-
Set the log level for Logstash. Possible values are:
-
fatal
: log very severe error messages that will usually be followed by the application aborting -
error
: log errors -
warn
: log warnings -
info
: log verbose info (this is the default) -
debug
: log debugging info (for developers) -
trace
: log finer-grained messages beyond debugging info
-
-
--config.debug
-
Show the fully compiled configuration as a debug log message (you must also have
--log.level=debug
enabled). WARNING: The log message will include any password options passed to plugin configs as plaintext, and may result in plaintext passwords appearing in your logs! -
-i, --interactive SHELL
- Drop to shell instead of running as normal. Valid shells are "irb" and "pry".
-
-V, --version
- Emit the version of Logstash and its friends, then exit.
-
-t, --config.test_and_exit
-
Check configuration for valid syntax and then exit. Note that grok patterns are not checked for
correctness with this flag. Logstash can read multiple config files from a directory. If you combine this
flag with
--log.level=debug
, Logstash will log the combined config file, annotating each config block with the source file it came from. -
-r, --config.reload.automatic
- Monitor configuration changes and reload whenever the configuration is changed. NOTE: Use SIGHUP to manually reload the config. The default is false.
-
--config.reload.interval RELOAD_INTERVAL
- How frequently to poll the configuration location for changes, in seconds. The default is every 3 seconds.
-
--http.host HTTP_HOST
- Web API binding host. This option specifies the bind address for the metrics REST endpoint. The default is "127.0.0.1".
-
--http.port HTTP_PORT
- Web API http port. This option specifies the bind port for the metrics REST endpoint. The default is 9600-9700. This setting accepts a range of the format 9600-9700. Logstash will pick up the first available port.
-
--log.format FORMAT
- Specify if Logstash should write its own logs in JSON form (one event per line) or in plain text (using Ruby’s Object#inspect). The default is "plain".
-
--path.settings SETTINGS_DIR
-
Set the directory containing the
logstash.yml
settings file as well as the log4j logging configuration. This can also be set through the LS_SETTINGS_DIR environment variable. The default is theconfig
directory under Logstash home. -
-h, --help
- Print help
On this page