I am new to elk stack . As per my understanding to make logs getting read from filebeat to logstash to kibana , below are steps.
Server setting : I have filebeat , logstash , kibana configured on different nodes.
Steps :
1. First start logstash.
2. Then start filebeat .
3. Registry is created on filebeat path / var/lob/filebeat/registry giving offset value once logstash acknowledges that data is read, otherwise it remains empty.
Problem Statement : Changes are made to one of the logs conf . eg : logstash-test-log.conf .
Note : There are other logs conf also being read .
Q1) In order to get the new changes being read I have to stop logstash and then restart . Is it going to impact the reading of other logs conf ?
Q2) Need to restart filebeat as well . Is this correct way ?
Q1:
Set the config.reload.automatic: true configuration on logstash.yml. So, logstash will not be required to stop running and thus affecting the remaining pipelines. It will be monitoring the pipelines and will trigger a reload when changes happens by itself.
Q2: Yes.