file

Milestone: 2

This output will write events to files on disk. You can use fields from the event as parts of the filename and/or path.

Synopsis

This is what it might look like in your config file:
output {
  file {
    codec => ... # codec (optional), default: "plain"
    flush_interval => ... # number (optional), default: 2
    gzip => ... # boolean (optional), default: false
    max_size => ... # string (optional)
    message_format => ... # string (optional)
    path => ... # string (required)
    workers => ... # number (optional), default: 1
  }
}

Details

codec

  • Value type is codec
  • Default value is "plain"

The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.

exclude_tags DEPRECATED

  • DEPRECATED WARNING: This config item is deprecated. It may be removed in a further version.
  • Value type is array
  • Default value is []

Only handle events without any of these tags. Note this check is additional to type and tags.

flush_interval

  • Value type is number
  • Default value is 2

Flush interval (in seconds) for flushing writes to log files. 0 will flush on every message.

gzip

  • Value type is boolean
  • Default value is false

Gzip the output stream before writing to disk.

max_size

  • Value type is string
  • There is no default value for this setting.

The maximum size of file to write. When the file exceeds this threshold, it will be rotated to the current filename + “.1” If that file already exists, the previous .1 will shift to .2 and so forth.

NOT YET SUPPORTED

message_format

  • Value type is string
  • There is no default value for this setting.

The format to use when writing events to the file. This value supports any string and can include %{name} and other dynamic strings.

If this setting is omitted, the full json representation of the event will be written as a single line.

path (required setting)

  • Value type is string
  • There is no default value for this setting.

The path to the file to write. Event fields can be used here, like “/var/log/logstash/%{host}/%{application}” One may also utilize the path option for date-based log rotation via the joda time format. This will use the event timestamp. E.g.: path => “./test-%{+YYYY-MM-dd}.txt” to create ./test-2013-05-29.txt

tags DEPRECATED

  • DEPRECATED WARNING: This config item is deprecated. It may be removed in a further version.
  • Value type is array
  • Default value is []

Only handle events with all of these tags. Note that if you specify a type, the event must also match that type. Optional.

type DEPRECATED

  • DEPRECATED WARNING: This config item is deprecated. It may be removed in a further version.
  • Value type is string
  • Default value is ""

The type to act on. If a type is given, then this output will only act on messages with the same type. See any input plugin’s “type” attribute for more. Optional.

workers

  • Value type is number
  • Default value is 1

The number of workers to use for this output. Note that this setting may not be useful for all outputs.


This is documentation from lib/logstash/outputs/file.rb