Testing logstash configs with Docker

Now this is really not rocket science, but since I might do this more often, I don’t want to google every time.

Prepare your directories

./tmp                   # THIS IS YOUR WORKING DIRECTORY
  |- patterns/          # optional
  |   |- patternfile1   # optional
  |   |- patternfile2   # optional
  |- logs.log
  |- logstash.conf

Prepare your logstash config

# logstash.conf
input {
  file {
    path => '/stash/logs.log'
  }
}

filter {
  # whatever config you want to test
  grok {
    match        => [ "message", "%{WHATEVER}" ]
    patterns_dir => '/stash/patterns'              # optional :)
  }
}

output {
  stdout { codec => rubydebug }
}

Run logstash

docker run --rm -ti -v $(pwd):/stash logstash logstash -f /stash/logstash.conf

Done.

Done. 🙂