IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Command-line flagsedit
Logstash has the following flags. You can use the --help flag to display this information.
-
-f, --config CONFIG_PATH - Load the Logstash config from a specific file or directory. If a directory is given, all files in that directory will be concatenated in lexicographical order and then parsed as a single config file. You can also specify wildcards (globs) and any matched files will be loaded in the order described above.
-
-e CONFIG_STRING -
Use the given string as the configuration
data. Same syntax as the config file. If no
input is specified, then the following is
used as the default input:
input { stdin { type => stdin } }and if no output is specified, then the following is used as the default output:output { stdout { codec => rubydebug } }. If you wish to use both defaults, please use the empty string for the-eflag. The default is "". -
-w, --pipeline-workers COUNT - Sets the number of pipeline workers to run. The default is 8.
-
-b, --pipeline-batch-size SIZE -
Size of batches the pipeline is to work in.
The default is 125.
This parameter defines the maximum number of
events an individual worker thread will collect
before attempting to execute its filters and
outputs. Larger batch sizes are generally more
efficient, but come at the cost of increased
memory overhead. You may have to increase the
JVM heap size by setting the
LS_HEAP_SIZEvariable to effectively use the option. -
-u, --pipeline-batch-delay DELAY_IN_MS - When creating pipeline event batches, how long to wait while polling for the next event. The default is 5ms.
-
-w, --filterworkers COUNT -
DEPRECATED. Now an alias for
--pipeline-workersand-w. -
-l, --log FILE - Write Logstash internal logs to the given file. Without this flag, Logstash will emit logs to standard output.
-
-v -
DEPRECATED. Increase verbosity of Logstash internal logs.
Specifying once will show informational
logs. Specifying twice will show debug
logs. This flag is deprecated. You should use
--verboseor--debuginstead. -
--quiet - Quieter Logstash logging. This causes only errors to be emitted.
-
--verbose - More verbose logging. This causes info level logs to be emitted.
-
--debug - Most verbose logging. This causes debug level logs to be emitted.
-
--debug-config -
Print the compiled config ruby code out as
a debug log (you must also have
--debugenabled). WARNING: This will include any password options passed to plugin configs as plaintext, and may result in plaintext passwords appearing in your logs! The default is false. -
-V, --version - Emit the version of Logstash and its friends, then exit.
-
-p, --pluginpath PATH -
A path of where to find plugins. This flag
can be given multiple times to include
multiple paths. Plugins are expected to be
in a specific directory hierarchy:
PATH/logstash/TYPE/NAME.rbwhereTYPEisinputs,filters,outputs, orcodecsandNAMEis the name of the plugin. -
-t, --configtest -
Check configuration for valid syntax and then exit.
Note that grok patterns are not checked for
correctness with this flag. Logstash can read multiple
config files from a directory. If you combine this
flag with
--debug, Logstash will log the combined config file, annotating the individual config blocks with the source file it came from. -
--[no-]allow-unsafe-shutdown - Force Logstash to exit during shutdown even if there are still inflight events in memory. By default, Logstash will refuse to quit until all received events have been pushed to the outputs. The default is false.
-
-r, --[no-]auto-reload - Monitor configuration changes and reload whenever the configuration is changed. NOTE: Use SIGHUP to manually reload the config The default is false.
-
--reload-interval RELOAD_INTERVAL - How frequently to poll the configuration location for changes, in seconds. The default is 3 seconds.
-
--allow-env -
[preview]
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Enables templating of environment variable
values. Instances of
${VAR}in strings will be replaced with the respective environment variable value named "VAR". The default is false. -
--[no-]log-in-json - Specify that Logstash should write its own logs in JSON form - one event per line. If false, Logstash will log using Ruby’s Object#inspect (not easy to machine-parse). The default is false.
-
-h, --help - Print help