Logstash Lines: Environment variables in Config

Welcome back to The Logstash Lines! In these weekly posts, we'll share the latest happenings in the world of Logstash and its ecosystem.

Fallout from 2.2 changes

In 2.2, we changed the pipeline to combine filters and output stages into one worker unit/thread. Some users upgrading to 2.2 complained about drop in throughput, mostly because of misconfiguration in pipeline workers setting. In 2.2, it is safe to bump the pipeline workers to say 2x * number of cores because there will be IO idle time resulting from filters and workers on the same execution unit. Although it seems that pipeline needs more threads, its also doing the additional output work. To help users upgrade, we released a blog post details this info.

Another side effect of this change was that certain outputs like ES now use more resources like file handles, sockets etc because the outputs were never optimized for running in so many threads. This week we worked on making ES output (and underlying elasticsearch-ruby client) to be thread-aware and to share resources like connections (#377)

Expanding Environment Variables inside LS Config

This has been a popular enhancement request by users, but since there's a workaround using config management tools and/or things like sed, awk we had been pushing it down the road. Recently, we decided to bite this bullet, and have been working with Fabien Baligand to implement this enhancement. It just got merged to master and 2.x. So now you can do:

input {
  tcp {
    port => "${LS_TCP_PORT:9999}"

output {#
  file {
     path => "${HOME}/file.log"

Pretty sweet and convenient. The syntax is “${myEnvVar: defaultVal}”. This behavior is also consistent with Beats product. Many thanks to Fabien for contributing this enhancement!

Beats input certificate verification

Beats input and its predecessor Lumberjack input had never actually verified client certificates against the CA (on the server side). We are fixing this, and also adding end to end Filebeat and Logstash integration tests with SSL.

Dynamic Config Reload

This feature has been backported to 2.3. With this, you don't have to restart Logstash when any configuration changes have been made. Stay tuned for the release of version 2.3.0 soon.

Other fixes:

  • --configtest position is relevant #4737
  • Add ability to configure custom gc log file #4718
  • Fix oops backtrace logging #4717
  • Specifying JMX parameters in LS_JAVA_OPTS causes Logstash not to restart properly #4319
  • Filewatch library complains if HOME or SINCEDB_PATH variables are unset #101
  • We're hiring

    Work for a global, distributed team where finding someone like you is just a Zoom meeting away. Flexible work with impact? Development opportunities from the start?