This output will write events to files on disk. You can use fields from the event as parts of the filename and/or path.
output {
file {
codec => ... # codec (optional), default: "plain"
flush_interval => ... # number (optional), default: 2
gzip => ... # boolean (optional), default: false
max_size => ... # string (optional)
message_format => ... # string (optional)
path => ... # string (required)
workers => ... # number (optional), default: 1
}
}
The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.
Only handle events without any of these tags. Note this check is additional to type and tags.
Flush interval (in seconds) for flushing writes to log files. 0 will flush on every message.
Gzip the output stream before writing to disk.
The maximum size of file to write. When the file exceeds this threshold, it will be rotated to the current filename + “.1” If that file already exists, the previous .1 will shift to .2 and so forth.
NOT YET SUPPORTED
The format to use when writing events to the file. This value supports any string and can include %{name} and other dynamic strings.
If this setting is omitted, the full json representation of the event will be written as a single line.
The path to the file to write. Event fields can be used here, like “/var/log/logstash/%{host}/%{application}” One may also utilize the path option for date-based log rotation via the joda time format. This will use the event timestamp. E.g.: path => “./test-%{+YYYY-MM-dd}.txt” to create ./test-2013-05-29.txt
Only handle events with all of these tags. Note that if you specify a type, the event must also match that type. Optional.
The type to act on. If a type is given, then this output will only act on messages with the same type. See any input plugin’s “type” attribute for more. Optional.
The number of workers to use for this output. Note that this setting may not be useful for all outputs.