stdin documentation unclear, do we need a sep config file?

[oppianmatt]

Couldn't see this in the docs, I could test it but would be better if it's documented.

Issue is if I have logstash-forwarder piping in from stdin, can I use the same configuration the daemon started from init.d is also using? That is if I run 2 logstash-forwarders, with one accepting stdin, but both pointing to the same configuration file. Will the file entries of the main one conflict with the second one? That is will the stdin try to read both the stdin and the files listed in the configuration, with 2 processes looking at the same file?

[driskell]

If you use the same configuration file you'll need to add a file entry for "-" which means stdin. So this means the daemon will also start reading from stdin - but since it will usually be /dev/null it probably won't do anything bad.

However, the non-daemon instance will also start reading from any other files in the config file, so yes you'll have two instances reading from log files.

Best to have separate configuration files, logstash-forwarder will always perform exactly what its told to do in the config file specified (unless there's a bug!)

[oppianmatt]

that's what I was afraid of, so now I've got 2 config files. One with just the stdin part and the other with the files.

It would make things easier if the stdin option could be specified from the command line since that's exactly what your doing to get it to run from stdin.

so if you went

command_that_outputs_logs | logstash-forwarder -config='/etc/logstash-forwarder' -

it would read the config for the server but seeing the - it would mean to take stdin (a common convention for unix) and then ignore the files sections so it doesn't double submit logs.

[oppianmatt]

one question, does the logstash-forwarder die after stdin is finished? Because it doesn't look like it.

2014/10/29 19:27:33.986887 Starting harvester: -
2014/10/29 19:27:33.986919 Current file offset: 0
2014/10/29 19:27:33.997350 Connecting to :5000 (log.example.com)
2014/10/29 19:27:34.061093 Connected to
2014/10/29 19:27:39.058851 Registrar received 167 events
2014/10/29 19:27:58.990476 Registrar received 2 events
2014/10/29 19:29:20.430609 File truncated, seeking to beginning: -

does that mean it finished and then it didn't quit? how can one seek to the beginning of stdin?

I've got commands that run via cron and I want to capture the stdout as they run. so I did:

command | logstash-forwarder config=/etc/logstash-forwarder-stdin

but does the logstash-forwarder process stop when stdin is finished?

[oppianmatt]

I guess that's this issue: #251