A Logstash pipeline has two required elements, input
and output
, and one optional element, filter
. The input
plugins consume data from a source, the filter
plugins modify the data as you specify, and the output
plugins write the data to a destination.
input {
file {
path => "/path/to/logstash-tutorial.log"
start_position => beginning
}
}
The default behavior of the file input plugin is to monitor a file for new information, in a manner similar to the UNIX tail -f
command. To change this default behavior and process the entire file, we need to specify the position where Logstash starts processing the file.