Reference » Output plugins » file
«  exec     graphtastic  »

file

boundary
csv
circonus
cloudwatch
datadog
datadog_metrics
elasticsearch
email
exec
file
graphtastic
ganglia
graphite
google_bigquery
google_cloud_storage
gelf
http
hipchat
irc
influxdb
jira
juggernaut
kafka
loggly
librato
lumberjack
mongodb
metriccatcher
nagios
nagios_nsca
null
opentsdb
pagerduty
pipe
rackspace
riak
riemann
redis
redmine
rabbitmq
solr_http
sns
syslog
stomp
statsd
stdout
sqs
s3
tcp
udp
websocket
xmpp
zabbix
zeromq

This output will write events to files on disk. You can use fields from the event as parts of the filename and/or path.

 

Synopsis

This plugin supports the following configuration options:

Required configuration options:

file {
    path => ...
}

Available configuration options:

Setting Input typeRequiredDefault value

codec

codec

No

"plain"

filename_failure

string

No

"_filepath_failures"

flush_interval

number

No

2

gzip

boolean

No

false

max_size

string

No

message_format

string

No

path

string

Yes

workers

number

No

1

Details

 

codec

  • Value type is codec
  • Default value is "plain"

The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.

exclude_tags (DEPRECATED)

  • DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
  • Value type is array
  • Default value is []

Only handle events without any of these tags. Note this check is additional to type and tags.

filename_failure

  • Value type is string
  • Default value is "_filepath_failures"

If the generated path is invalid, the events will be saved into this file and inside the defined path.

flush_interval

  • Value type is number
  • Default value is 2

Flush interval (in seconds) for flushing writes to log files. 0 will flush on every message.

gzip

  • Value type is boolean
  • Default value is false

Gzip the output stream before writing to disk.

max_size

  • Value type is string
  • There is no default value for this setting.

The maximum size of file to write. When the file exceeds this threshold, it will be rotated to the current filename + ".1" If that file already exists, the previous .1 will shift to .2 and so forth.

NOT YET SUPPORTED

message_format

  • Value type is string
  • There is no default value for this setting.

The format to use when writing events to the file. This value supports any string and can include %{name} and other dynamic strings.

If this setting is omitted, the full json representation of the event will be written as a single line.

path

  • This is a required setting.
  • Value type is string
  • There is no default value for this setting.

The path to the file to write. Event fields can be used here, like /var/log/logstash/%{host}/%{application} One may also utilize the path option for date-based log rotation via the joda time format. This will use the event timestamp. E.g.: path => "./test-%{+YYYY-MM-dd}.txt" to create ./test-2013-05-29.txt

If you use an absolute path you cannot start with a dynamic string. E.g: /%{myfield}/, /test-%{myfield}/ are not valid paths

tags (DEPRECATED)

  • DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
  • Value type is array
  • Default value is []

Only handle events with all of these tags. Note that if you specify a type, the event must also match that type. Optional.

type (DEPRECATED)

  • DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
  • Value type is string
  • Default value is ""

The type to act on. If a type is given, then this output will only act on messages with the same type. See any input plugin’s type attribute for more. Optional.

workers

  • Value type is number
  • Default value is 1

The number of workers to use for this output. Note that this setting may not be useful for all outputs.

«  exec     graphtastic  »