By Wei Bin, CTO of Puxiang Communication Technology
Logstash is the most powerful extract, transform, and load (ETL) tool in the Elastic Stack. Logstash is slightly larger than Beats, but it provides rich features and powerful processing capabilities. You may have experienced Logstash's slow startup speed. Is there any way to reduce the wait time when Logstash starts and improve the efficiency of profile editing and processing? This article proposes a technique to help you resolve these two problems so that you can make better use of this powerful tool.
When you start Logstash, you can add the -r parameter to hot-reload the profile. The following content describes the operation results.
After you modify the profile, the new profile automatically takes effect, and you do not need to restart Logstash.
The following figure shows the definition of the -r
parameter.
After you edit a profile, such as the test.conf file, run the following startup command:
bin/logstash -f test.conf -r
After the startup is complete, modify the content of the test.conf file and save it. After 1 second, Logstash generates a log output similar to the following code. In particular, the part marked in the red box indicates that the file has been reloaded.
If an error occurs in the new profile, you will see an error log in Logstash and can fix the problem based on the error information provided.
This resolves the first problem.
Another difficulty in editing a profile is the detailed testing required for the input content in different formats. This operation prevents parsing errors. Previously, we usually resolved this problem by using standard input methods, such as the stdin input method. However, standard input methods did not support advanced text editing, and the profile hot-reloading feature does not support standard input methods.
To address this problem, we recommend that you use the http input plug-in. The following code shows how to configure this plug-in.
input{
http{
port => 7474
codec => "json"
}
}
Then, you can use your favorite http request tool, such as POSTMan or Insomnia, to send the to-be-tested content to http://localhost:7474
. The following figure is a screenshot of Insomnia.
This solves the second problem.
I am sure you are eager to try out what you have learned. You can open your computer, open Logstash, and edit the test.conf file by entering the following code:
input{
http{
port => 7474
codec => "json"
}
}
filter{
}
output{
stdout{
codec => rubydebug{
metadata => true
}
}
}
Then, run the following startup command:
bin/logstash -f test.conf -r
Open Insomnia, enter the content to be tested, and click Send to start editing profiles.
Wei Bin, CTO of Puxiang Communication Technology, is an open-source software advocate. He was the first Elastic certified engineer in China and the initiator of the community projects Elastic Daily and Elastic Talk. Wei Bin was awarded the 2019 Annual Partner Architect - Special Contribution Award by Elastic China. He has rich practical experiences in open-source software such as Elasticsearch, Kibana, Beats, Logstash, and Grafana. He provides consulting and training services for customers in many industries, including retail, finance, insurance, securities, and technology. He helps customers identify the roles of open-source software in their business, implement open-source software from scratch, and scale it out to produce business value.
Declaration: This article is adapted from "Logstash Techniques You Must Master" with the authorization from the author Wei Bin. We reserve the right to investigate unauthorized use.
Alibaba Cloud Native Community - August 14, 2024
Alibaba Clouder - December 30, 2020
Alibaba Clouder - December 29, 2020
Alibaba Clouder - February 14, 2020
Alibaba Cloud Native Community - December 6, 2022
Alibaba Clouder - January 7, 2021
Alibaba Cloud provides big data consulting services to help enterprises leverage advanced data technology.
Learn MoreAlibaba Cloud experts provide retailers with a lightweight and customized big data consulting service to help you assess your big data maturity and plan your big data journey.
Learn MoreAlibaba Cloud Elasticsearch helps users easy to build AI-powered search applications seamlessly integrated with large language models, and featuring for the enterprise: robust access control, security monitoring, and automatic updates.
Learn MoreApsaraDB for HBase is a NoSQL database engine that is highly optimized and 100% compatible with the community edition of HBase.
Learn MoreMore Posts by Data Geek
Dikky Ryan Pratama May 9, 2023 at 5:43 am
very easy article to understand