What is the format of logstash config file

The Logstash configuration file is a custom format developed by the Logstash folks using Treetop.

The grammar itself is described in the source file grammar.treetop and compiled using Treetop into the custom grammar.rb parser.

That parser is then used by the pipeline.rb file in order to set up the pipeline from the Logstash configuration.

If you're not that much into Ruby, there's another interesting project called node-logstash which provides a Logstash implementation in Node.js. The configuration format is exactly the same as with the official Logstash, though the parser is obviously a different one written for Node.js. In this project, the Logstash configuration file grammar is described in jison and the parser is also automatically generated, but could be used by any Node.js module simply by requiring that generated parser.


You can use the following command to verify your logstash config file is valid:

bin/logstash --configtest --config <your config file>

Apparently command line arguments have been updated since the answers have been posted and --configtest and --config arguments are no longer valid. In order to ask Logstash (at least v5) to validate config file:

bin/logstash -t -f config.conf

With expanded arguments it looks like this:

bin/logstash --config.test_and_exit --path.config config.conf