CODEWITHSUNDEEP
logstashlogstash-configurationlogstash-file
DaPoox
DaPoox

Reputation: 149

Logstash doesn't start until the input file is modified

I have a log file, the path is in the configuration file of Logstash. The problem is that when I launch Logstash, nothing happens until I modify the file (Add a space, add a line etc..). Note that I copy the file into the correct path and then I launch Logstash. I tried like launching Logstash before copying the file into the correct path, same behavior. 

input {
file {
    path => "C:\users\Path\To\Logs\logSample.log"
    codec => multiline {
        pattern => "^(\d{4}-\d{2}-\d{2}\s*)?\d{2}:\d{2}:\d{2},\d{3}" # Time indicates a new line.
        negate => true
        what => previous
        charset => "ASCII"
    }
}

}

What I want to do is launch Logstash while the files are already in the correct folder and make Logstash start analysing them directly.

Upvotes: 0

Views: 119

Answers (1)

whites11
whites11

Reputation: 13360

Logstash keeps an index file where it stores for each file indicated in the "path" config which is the last line that has been sent over. If you want to start from scratch and send the whole file again, than you can:

  1. rename the source file
  2. drop the index file

The index file is specified by using the sincedb_path config param and defaults to <path.data>/plugins/inputs/file

Upvotes: 1

Related Questions