- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Upgrading Logstash
- Configuring Logstash
- Advanced Logstash Configurations
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Queues and data resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring Logstash with APIs
- Working with plugins
- Integration plugins
- Input plugins
- azure_event_hubs
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elastic_agent
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_cloud_storage
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- java_generator
- java_stdin
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- s3-sns-sqs
- salesforce
- snmp
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- dynatrace
- elastic_app_search
- elastic_workplace_search
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_cloud_storage
- google_pubsub
- graphite
- graphtastic
- http
- influxdb
- irc
- java_stdout
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sink
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- age
- aggregate
- alter
- bytes
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- http
- i18n
- java_uuid
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- memcached
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- threats_classifier
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- wurfl_device_detection
- xml
- Codec plugins
- Tips and best practices
- Troubleshooting
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- How to write a Logstash output plugin
- Logstash Plugins Community Maintainer Guide
- Document your plugin
- Publish your plugin to RubyGems.org
- List your plugin
- Contributing a patch to a Logstash plugin
- Extending Logstash core
- Contributing a Java Plugin
- Glossary of Terms
- Breaking Changes
- Release Notes
- Logstash 7.17.26 Release Notes
- Logstash 7.17.25 Release Notes
- Logstash 7.17.24 Release Notes
- Logstash 7.17.23 Release Notes
- Logstash 7.17.22 Release Notes
- Logstash 7.17.21 Release Notes
- Logstash 7.17.20 Release Notes
- Logstash 7.17.19 Release Notes
- Logstash 7.17.18 Release Notes
- Logstash 7.17.17 Release Notes
- Logstash 7.17.16 Release Notes
- Logstash 7.17.15 Release Notes
- Logstash 7.17.14 Release Notes
- Logstash 7.17.13 Release Notes
- Logstash 7.17.12 Release Notes
- Logstash 7.17.11 Release Notes
- Logstash 7.17.10 Release Notes
- Logstash 7.17.9 Release Notes
- Logstash 7.17.8 Release Notes
- Logstash 7.17.7 Release Notes
- Logstash 7.17.6 Release Notes
- Logstash 7.17.5 Release Notes
- Logstash 7.17.4 Release Notes
- Logstash 7.17.3 Release Notes
- Logstash 7.17.2 Release Notes
- Logstash 7.17.1 Release Notes
- Logstash 7.17.0 Release Notes
- Logstash 7.16.3 Release Notes
- Logstash 7.16.2 Release Notes
- Logstash 7.16.1 Release Notes
- Logstash 7.16.0 Release Notes
- Logstash 7.15.2 Release Notes
- Logstash 7.15.1 Release Notes
- Logstash 7.15.0 Release Notes
- Logstash 7.14.2 Release Notes
- Logstash 7.14.1 Release Notes
- Logstash 7.14.0 Release Notes
- Logstash 7.13.4 Release Notes
- Logstash 7.13.3 Release Notes
- Logstash 7.13.2 Release Notes
- Logstash 7.13.1 Release Notes
- Logstash 7.13.0 Release Notes
- Logstash 7.12.1 Release Notes
- Logstash 7.12.0 Release Notes
- Logstash 7.11.2 Release Notes
- Logstash 7.11.1 Release Notes
- Logstash 7.11.0 Release Notes
- Logstash 7.10.2 Release Notes
- Logstash 7.10.1 Release Notes
- Logstash 7.10.0 Release Notes
- Logstash 7.9.3 Release Notes
- Logstash 7.9.2 Release Notes
- Logstash 7.9.1 Release Notes
- Logstash 7.9.0 Release Notes
- Logstash 7.8.1 Release Notes
- Logstash 7.8.0 Release Notes
- Logstash 7.7.1 Release Notes
- Logstash 7.7.0 Release Notes
- Logstash 7.6.2 Release Notes
- Logstash 7.6.1 Release Notes
- Logstash 7.6.0 Release Notes
- Logstash 7.5.2 Release Notes
- Logstash 7.5.1 Release Notes
- Logstash 7.5.0 Release Notes
- Logstash 7.4.2 Release Notes
- Logstash 7.4.1 Release Notes
- Logstash 7.4.0 Release Notes
- Logstash 7.3.2 Release Notes
- Logstash 7.3.1 Release Notes
- Logstash 7.3.0 Release Notes
- Logstash 7.2.1 Release Notes
- Logstash 7.2.0 Release Notes
- Logstash 7.1.1 Release Notes
- Logstash 7.1.0 Release Notes
- Logstash 7.0.1 Release Notes
- Logstash 7.0.0 Release Notes
- Logstash 7.0.0-rc2 Release Notes
- Logstash 7.0.0-rc1 Release Notes
- Logstash 7.0.0-beta1 Release Notes
- Logstash 7.0.0-alpha2 Release Notes
- Logstash 7.0.0-alpha1 Release Notes
Reloading the Config File
editReloading the Config File
editYou can set Logstash to detect and reload configuration changes automatically.
To enable automatic config reloading, start Logstash with the --config.reload.automatic
(or -r
)
command-line option specified. For example:
bin/logstash -f apache.config --config.reload.automatic
The --config.reload.automatic
option is not available when you specify the -e
flag to pass
in configuration settings from the command-line.
By default, Logstash checks for configuration changes every 3 seconds. To change this interval,
use the --config.reload.interval <interval>
option, where interval
specifies how often Logstash
checks the config files for changes (in seconds).
Note that the unit qualifier (s
) is required.
Force reloading the config file
editIf Logstash is already running without auto-reload enabled, you can force Logstash to reload the config file and restart the pipeline. Do this by sending a SIGHUP (signal hangup) to the process running Logstash. For example:
kill -SIGHUP 14175
Where 14175 is the ID of the process running Logstash.
This functionality is not supported on Windows OS.
How automatic config reloading works
editWhen Logstash detects a change in a config file, it stops the current pipeline by stopping all inputs, and it attempts to create a new pipeline that uses the updated configuration. After validating the syntax of the new configuration, Logstash verifies that all inputs and outputs can be initialized (for example, that all required ports are open). If the checks are successful, Logstash swaps the existing pipeline with the new pipeline. If the checks fail, the old pipeline continues to function, and the errors are propagated to the console.
During automatic config reloading, the JVM is not restarted. The creating and swapping of pipelines all happens within the same process.
Changes to grok pattern files are also reloaded, but only when a change in the config file triggers a reload (or the pipeline is restarted).
In general, Logstash is not watching or monitoring any configuration files used or referenced by inputs, filters or outputs.
Plugins that prevent automatic reloading
editInput and output plugins usually interact with OS resources. In some circumstances those resources can’t be released without a restart. For this reason some plugins can’t be simply updated and this prevents pipeline reload.
The stdin input plugin, for example, prevents reloading for these reasons.
On this page
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now