elasticsearch - How to setup Logstash so that default configure file is read when it start up automatically as a service -
i'm trying setup logstash because want forward apache log info elasticsearch. , want start logstash process automatically when server start.
i resister logstash service , start process automatically, seems configure file has not been read service. , when start logstash using -f option work correctly, so, can contents of config file has no problem.
it's manual says , if place *.conf file under /etc/logstash/conf.d/ , service read configure file when start, never work expected.
how should configure logstash read config file when start?
this config file , has been placed on /etc/logstash/conf.d/01-httpdlog.conf
input { file { path => "/etc/httpd/logs/access_log" start_position => beginning } } filter { grok { match => { "message" => "%{combinedapachelog}"} } } output { elasticsearch { hosts => ["xxx.xxx.xxx.xxx:9200"] } file{ path => "/tmp/result.txt" } stdout {} }
it's pretty user running logstash service doesn't have permission read apache log files.
you need chmod 755
apache logs folder (in /etc/httpd/logs
) , should work better.
Comments
Post a Comment