CODEWITHSUNDEEP
jsonlogstashelastic-stacklogstash-configuration
ItayD
ItayD

Reputation: 533

Logstash reads data from stdin but not from file

I have a JSON log file with only one line in it:

{"@timestamp":"2016-06-02T13:56:49.235+00:00","thread_name":"qtp485047320-228","level":"ERROR","host":"domain.com","class":"MyClass","url":"/my-url","ip":"12.122.122.122","message":"Exception caught by exception handler.","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36","stacktrace":"com.test.exceptions.NotFoundException: NotFoundException for parameter [12345678-1234]. Message: url was not found by service.]"}

And this is my logstash.conf file:

input {
     # stdin {}
    file {
      path => "/Users/me/Applications/logstash-2.3.1/examples/json_input.1.log"
      start_position => "beginning"
    }
}
filter {

    json{
        source => "message"
    }

    geoip {
        source => "ip"
        target => "geoip"
    }
}
output {
    stdout { 
        codec => rubydebug 
    }
    elasticsearch { 
        hosts => ["localhost:9200"]
        index => "logstash-app-errors"
    }
}

As you can see, at the input section I used stdin (in comment now) and later on, I changed to read the data from file.
The problem is that when I use the stdin and paste the json data (1 line) everything works great and I see the data in elasticSearch, but when I change it to file, nothing happens...
I also added --debug param to logstash execution command ./logstash agent -f logstash.conf --debug but couldn't see anything suspicious in debug output.

What am I missing?

Upvotes: 2

Views: 6031

Answers (1)

ItayD
ItayD

Reputation: 533

Found the issue - if the input file has only one line of data, you should add an empty new line. That resolved my issue. can't believe I spent so much time on that one...

Edit:
Opened an issue to elastic, you can follow the issue status here

Upvotes: 3

Related Questions