CODEWITHSUNDEEP
logstash
pkaramol
pkaramol

Reputation: 19432

Logstash: Simplest pipeline possible not working

Using logstash 2.4 (I have my reasons) on Ubuntu 16.04

root@logbox:/etc/logstash/conf.d# ls -al
total 16
drwxrwxr-x 2 root root 4096 Nov  2 19:53 .
drwxrwxr-x 3 root root 4096 Nov  2 15:46 ..
-rwxrwxrwx 1 root root  277 Nov  2 19:52 01_01_input.conf
-rwxrwxrwx 1 root root  604 Nov  2 19:48 03_02_output_pa_http.conf


root@logbox:/etc/logstash/conf.d# cat *.conf

input {

  stdin {}

  file {
    path => "/usr/share/logstash/files/production_input.txt"
    start_position => "beginning"
    # codec => plain { charset => "ISO-8859-1" }
    codec => json
    # add_field => [ 'redis_db', '10' ]
  }



}
output {

  stdout {}

}


root@logbox:/etc/logstash/conf.d# ls -al /usr/share/logstash/files/production_input.txt
-rwxrwxrwx 1 root root 11910 Nov  2 16:09 /usr/share/logstash/files/production_input.txt

However...

vagrant@logbox:/etc/logstash/conf.d$ sudo tail -f /var/log/logstash/logstash*


Sending logstash logs to /var/log/logstash/logstash.log.

==> /var/log/logstash/logstash.log <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}

==> /var/log/logstash/logstash.stdout <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}

The file is not printed in stdout...I have tried both codecs (json and plain)

edit: actually it might be the case the file has been read only once; does this have to do with sincedb? how do I force logstash to read it again? isn't start_position => beginning enough?

Upvotes: 0

Views: 131

Answers (1)

Fares
Fares

Reputation: 650

start_position is used the first time the file is read.

If you want to force logstash to read it again, you need to add in your file input plugin conf this parameter : sincedb_path => "/dev/null"

Please read this for further explanation How to force Logstash to reparse a file?

Upvotes: 1

Related Questions