Reload logstash config file automatically

Tags: logstash elk

Categories: monitoring

Logstash config file is usually located on path /etc/logstash/logstash.yml.
In config file find line config.reload.automatic, uncomment line and set it to true.

# logstash.yml
#
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
config.reload.automatic: true

By default, logstash checks for configuration change every 3s. If you want to change this, set config.reload.interval to interval that you want.

Interval must to have unit qualifier at the end (s)

# logstash.yml
#
# How often to check if the pipeline configuration has changed (in seconds)
#
config.reload.interval: 60s

How automatic config reload works

When Logstash detects a change in a config file, it stops the current pipeline by stopping all inputs, and it attempts to create a new pipeline that uses the updated configuration. After validating the syntax of the new configuration, Logstash verifies that all inputs and outputs can be initialized (for example, that all required ports are open). If the checks are successful, Logstash swaps the existing pipeline with the new pipeline. If the checks fail, the old pipeline continues to function, and the errors are propagated to the console.
During automatic config reloading, the JVM is not restarted. The creating and swapping of pipelines all happens within the same process.