logstash/docs/configuration.md

title	layout
Configuration Language - logstash	content_right

LogStash Config Language

The logstash config language aims to be simple.

There's 3 main sections: inputs, filters, outputs. Each section has configurations for each plugin available in that section.

Example:

# This is a comment. You should use comments to describe
# parts of your configuration.
input {
  ...
}

filter {
  ...
}

output {
  ...
}

Filters and Ordering

For a given event, are applied in the order of appearance in the config file.

Comments

Comments are as in ruby, perl, and python. Starts with a '#' character. Example:

# this is a comment

Value Types

The documentation for a plugin may say that a config field has a certain type. Examples include boolean, string, array, number, hash, etc.

Boolean

A boolean must be either true or false.

Examples:

debug => true

String

A string must be a single value.

Example:

name => "Hello world"

Single, unquoted words are valid as strings, too, but you should use quotes.

Number

Numbers must be valid numerics (floating point or integer are OK)

Example:

port => 33

Array

An 'array' can be a single string value or multiple. If you specify the same field multiple times, it appends to the array.

Examples:

path => [ "/var/log/messages", "/var/log/*.log" ]
path => "/data/mysql/mysql.log"

The above makes 'path' a 3-element array including all 3 strings.

Hash

A 'hash' is currently represented using the same syntax as an array (see above). The 'key' and 'value' are simply pairs, such as:

match => [ "field1", "pattern1", "field2", "pattern2" ]

The above would internally be represented as this hash: { "field1" => "pattern1", "field2" => "pattern2" }

Why this syntax? Well frankly it was easier than adding additional grammar to the config language. Logstash may support ruby- or json-like hash syntax in the future, but not today.

Further reading

For more information, see the plugin docs index