CODEWITHSUNDEEP
elasticsearchlogstash
Gck
Gck

Reputation: 25

logstash stucks after run command

I've defined this config file

input {
  file {
    path => "C:\Users\Jack\Desktop\logsatash_practice"
    type => "txt"
  }
}


output {
  file {
    path => "C:\Users\Jack\Desktop\logsatash_practice\op"
  }
}

and ran "logstash agent -f local_config.conf" command via cmd.

after that I get a message, and then nothing happend for more than 1 hour.

the printed message: "C:\Users\Jack\Desktop\logstash-1.4.2\bin>logstash agent -f local_config.conf ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin mi lestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}←[ 0m ←[33mUsing milestone 2 output plugin 'file'. This plugin should be stable, but i f you see strange behavior, please let us know! For more information on plugin m ilestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}← [0m"

To be sure, I verfied that the config file exists in the path that I defined in the config file.

any ideas?

Upvotes: 0

Views: 105

Answers (1)

rutter
rutter

Reputation: 11452

The first time Logstash sees a file, its behavior depends on the start_position you set. You seem to expect it will read from the beginning of the file, but default behavior is to start from the end.

So, you might want:

  file {
    path => "C:\Users\Jack\Desktop\logsatash_practice"
    type => "txt"
    start_position => "beginning"
  }

But, each time Logstash sees a file, it marks its progress with a sincedb entry. Now that Logstash has seen your file once, it won't treat it as a "new" file anymore. If you remove the entry and restart Logstash, it will forget that it has seen the file.

The sincedb data is kept in files. You can specify a path for them, but the default setting will keep them in your home directory.

If you're just practicing and don't care about your data, yet, you can simply delete all of them.

If you do want to be careful, you can run Logstash with -v to print out each sincedb path, and find the specific file that you need to remove.

Upvotes: 1

Related Questions