Reload Logstash configuration automatically

Start Logstash with --config.reload.automatic to watch pipeline configuration files for changes. The default polling interval is three seconds; set an explicit interval if needed.

bin/logstash -f /etc/logstash/conf.d/ \
  --config.reload.automatic \
  --config.reload.interval 5s

For a service installation, place the settings in the logstash.yml actually used by that service:

config.reload.automatic: true
config.reload.interval: 5s

Understand what reload does

A reload replaces a pipeline inside the existing JVM. Logstash stops the inputs, checks the replacement configuration and plugin initialization, and swaps the pipeline when those checks succeed. If replacement validation fails, the previous pipeline continues and Logstash reports the error.

This is not a universal zero-interruption or zero-loss guarantee. Input connections may close, and recovery depends on the source protocol, acknowledgments, buffering, and queue durability. File inputs use their recorded sincedb positions; a persistent queue improves recovery but has its own checkpoint and disk-failure limits.

Some plugins prevent automatic reload because their resources cannot be cleanly released. The stdin input is a documented example. Do not assume a separate grok pattern file is watched independently: a pipeline configuration change or restart is needed to trigger its reload.

Validate a change before rollout

bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/

After this check succeeds, replace the intended configuration, inspect the reload logs, and verify events reach the destination with the expected fields. A configuration test does not prove source access, parser correctness, or output delivery.

For a manual reload on supported Unix systems, send SIGHUP to the correct Logstash process. This mechanism is not available on Windows. Keep the previous configuration ready to restore if the new pipeline starts but produces incorrect results.

References

• Elastic: reloading config
• Elastic: running logstash command line
• Elastic: persistent queues