Reloading the Config File

You can set Logstash to detect and reload configuration changes automatically.

To enable automatic config reloading, start Logstash with the --config.reload.automatic (or -r) command-line option specified. For example:

bin/logstash -f apache.config --config.reload.automatic

By default, Logstash checks for configuration changes every 3 seconds. To change this interval, use the --config.reload.interval <interval> option, where interval specifies how often Logstash checks the config files for changes (in seconds).

Note that the unit qualifier (s) is required.

If Logstash is already running without auto-reload enabled, you can force Logstash to reload the config file and restart the pipeline. Do this by sending a SIGHUP (signal hangup) to the process running Logstash. For example:

kill -SIGHUP 14175

Where 14175 is the ID of the process running Logstash.

When Logstash detects a change in a config file, it stops the current pipeline by stopping all inputs, and it attempts to create a new pipeline that uses the updated configuration. After validating the syntax of the new configuration, Logstash verifies that all inputs and outputs can be initialized (for example, that all required ports are open). If the checks are successful, Logstash swaps the existing pipeline with the new pipeline. If the checks fail, the old pipeline continues to function, and the errors are propagated to the console.

During automatic config reloading, the JVM is not restarted. The creating and swapping of pipelines all happens within the same process.

Changes to grok pattern files are also reloaded, but only when a change in the config file triggers a reload (or the pipeline is restarted).

In general, Logstash does not watch or monitor configuration files used or referenced by inputs, filters, or outputs, except for supported TLS files when ssl.reload.automatic is enabled.

To automatically reload TLS certificate files for pipelines and X-Pack services, enable both config.reload.automatic: true and ssl.reload.automatic: true.

This feature watches TLS files referenced by the following SSL settings:

• ssl_certificate
• ssl_key
• ssl_certificate_authorities
• ssl_keystore_path
• ssl_truststore_path

For pipelines, if one of these files changes on disk, Logstash reloads only the affected pipelines. Unrelated pipelines continue to run.

For centralized pipeline management and legacy internal collection for monitoring, Logstash also picks up TLS certificate changes for the Elasticsearch connections they use to fetch pipeline definitions and ship monitoring data.

The Logstash API server supports the same behavior for its keystore file, regardless of ssl.reload.automatic. When the file referenced by api.ssl.keystore.path is replaced on disk, the API server uses the new certificate on subsequent client connections without requiring a Logstash restart.

Input and output plugins usually interact with OS resources. In some circumstances those resources can’t be released without a restart. For this reason some plugins can’t be simply updated and this prevents pipeline reload.

The stdin input plugin, for example, prevents reloading for these reasons.