This post is older than a year. Consider some information might not be accurate anymore.
Structure of a config file: A Logstash config file has a separate section for each type of plugin you want to add to the event processing pipeline.
# basic scheme
input {}
filter {}
output {}
Use input directory: Instead of one config file, you can split each section(s) into separate files. Instead of the file you omit an input directory. Start logstash with input directory
bin/logstash -f /etc/logstash.d
- you can use a directory (
/etc/logstash.d) as the value for the config input - will use all files in this directory
- loaded in lexicographical order of the files
Example layout: Contents of /etc/logstash.d
1_file-input.conf
1_udp-input.conf
2_filter.conf
3_debug-output.conf
4_elasticsearch-output.conf
