file

Status: beta

File output.

Write events to files on disk. You can use fields from the event as parts of the filename.

Synopsis

This is what it might look like in your config file:

output {
  file {
    flush_interval => ... # number (optional), default: 2
    gzip => ... # boolean (optional)
    max_size => ... # string (optional)
    message_format => ... # string (optional)
    path => ... # string (required)
    tags => ... # array (optional), default: []
    type => ... # string (optional), default: ""
  }
}

Details

flush_interval

• Value type is number
• Default value is 2

Flush interval for flushing writes to log files. 0 will flush on every meesage

gzip

• Value type is boolean
• There is no default value for this setting.

Gzip output stream

max_size

• Value type is string
• There is no default value for this setting.

The maximum size of file to write. When the file exceeds this threshold, it will be rotated to the current filename + ".1" If that file already exists, the previous .1 will shift to .2 and so forth.

NOT YET SUPPORTED

message_format

• Value type is string
• There is no default value for this setting.

The format to use when writing events to the file. This value supports any string and can include %{name} and other dynamic strings.

If this setting is omitted, the full json representation of the event will be written as a single line.

path (required setting)

• Value type is string
• There is no default value for this setting.

The path to the file to write. Event fields can be used here, like "/var/log/logstash/%{@source_host}/%{application}"

tags

• Value type is array
• Default value is []

Only handle events with all of these tags. Note that if you specify a type, the event must also match that type. Optional.

type

• Value type is string
• Default value is ""

The type to act on. If a type is given, then this output will only act on messages with the same type. See any input plugin's "type" attribute for more. Optional.

---

This is documentation from lib/logstash/outputs/file.rb