修改Logstash配置后重启相关问题咨询（ELK Stack新手）

Hey there! Since you're new to the ELK Stack with Filebeat, Logstash, and Kibana spread across different nodes, let's walk through your questions clearly:

问题1：为使新配置生效需重启Logstash，此操作是否会影响其他日志配置的读取？ #

Short answer: Yes, by default it will affect other running configurations—but there are workarounds if you need to avoid downtime.

Here's the breakdown:

• Logstash runs as a single process by default, which manages all configured pipelines (your different log config files). When you restart Logstash, the entire process shuts down, meaning all active pipelines stop processing logs temporarily until the service comes back up.
• After restarting, Logstash will reload all your configuration files (including the modified one and your existing running configs), so once it's back online, all pipelines will resume processing their respective logs.
• If you want to avoid affecting other pipelines during updates, you can use Logstash's multi-pipeline setup via the pipelines.yml file. This lets you run each pipeline as an independent process, so you can restart just the specific pipeline tied to your modified config without touching the others. Containerized deployments (like Docker) also make this easier by running each pipeline in a separate container.

Before restarting, always validate your modified config first to avoid startup failures:

logstash -f /path/to/logstash-test-log.conf --config.test_and_exit

问题2：是否需要重启Filebeat？该操作方式是否正确？ #

No, you don't need to restart Filebeat when updating Logstash configurations—your current approach is on the right track.

Why this works:

• Filebeat's job is to ship logs to Logstash, and it has built-in retry logic. When Logstash goes down for restart, Filebeat will buffer logs locally and keep trying to reconnect. Once Logstash is back online, Filebeat will resume sending logs from where it left off (thanks to the registry file at /var/log/filebeat/registry that tracks offsets).
• You only need to restart Filebeat if you modify Filebeat's own configuration (like changing log paths, output settings, etc.). Since you're only updating Logstash's config, Filebeat doesn't need any changes.

Just to recap the correct workflow for your scenario:

1. Validate your modified Logstash config with the test command above.
2. Restart the Logstash service (e.g., systemctl restart logstash on systemd-based systems).
3. Let Filebeat automatically reconnect—no action needed on the Filebeat side.

内容的提问来源于stack exchange，提问作者codninja0908