By default logstash writes the position is last was on to a logfile which usually resides in $HOME/.sincedb. Logstash can be fooled into believing it never parsed the logfile by specifying /dev/null as sincedb_path. Here the part of the documentation Input File. Where to write the since database (keeps track of the current position of … Read more
Should I run as many instances as I have different types of logs? No! You can only run one instance to handle different types of logs. In the logstash configuration file, you can specific each input with different type. Then in the filter you can use if to distinct different processing, and also at the … Read more
After evaluating both Redis and RabbitMQ I chose RabbitMQ as our broker for the following reasons: RabbitMQ allows you to use a built in layer of security by using SSL certificates to encrypt the data that you are sending to the broker and it means that no one will sniff your data and have access … Read more