11 Useful Logstash Command Lines

Here is a list of some useful command lines for Logstash. 

** If you haven’t read our article What is Logstash? and you want to learn more about Logstash plugins, installation and configuration, Beats, and Logstash alternatives click here.

The typical location for Logstash binaries installed with Debian or RPM packages is: /usr/share/logstash/bin. The following commands run from the Logstash executable directory.

  1. Run a particular pipeline configuration from the command prompt:
./logstash -f <name and path of configuration file>

 2. Load a configuration file and test it for correctness rather than running it:

./logstash -f <name and path of configuration file> --config.test_and_exit true


3. Monitor configuration changes and reload it whenever there’s a change:

./logstash -f <name and path of configuration file> --config.reload.automatic true

4. Edit Logstash default behavior, change settings in the logstash.yml file:

vi /etc/logstash/logstash.yml

5. Define custom pipelines, edit the pipelines.yml file and add pipeline ID, pipeline config path, and other parameters like queue persistence or number of workers.

This is useful when the Logstash instance is to process multiple unrelated pipelines: 

vi /etc/logstash/pipelines.yml

6. Check if Logstash service is running:

systemctl status logstash.service

7. Check Logstash error log:

tail -f /var/log/logstash/logstash-plain.log

8. To check what plugins are available in the system:

./logstash-plugin list --group <input/output/filter>

9. Specify a path where Logstash should look for plugins (Plugins are expected to be in a specific directory hierarchy like  /logstash/TYPE/NAME.rb’ where TYPE can be  ‘inputs’ ‘filters’, ‘outputs’ or ‘codecs’ and NAME is the name of the plugin):

./logstash --path.plugins 

10. Install a plugin from RubyGems.org:

./logstash-plugin install 

11. Update a specific plugin (omit plugin name to update all plugins):

./logstash-plugin update