I have a file of logging records I am using to debug some "filter" parses.
I am using "file" input and have set "starting_position" to "beginning".
So I startup logstash see what I get and killed it and make fixes and go
again. I have seen if sometimes it reads the file and sometimes not. I
ran some experiments and found that if I delete the file and rewrite it and
then start up logstash it reads the file. If I have previously read the
file, then when logstash starts it doesn't read the file despite being
told to start at beginning.
Am I missing something here? Is this intended behavior or a possible bug?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/7ad0633b-0e9d-4f10-8881-5a34c93c9500%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
On Friday, May 01, 2015 at 21:04 CEST,
Sitka sitkawoof@gmail.com wrote:
I have a file of logging records I am using to debug some "filter"
parses. I am using "file" input and have set "starting_position" to
"beginning". So I startup logstash see what I get and killed it and
make fixes and go again. I have seen if sometimes it reads the file
and sometimes not. I ran some experiments and found that if I delete
the file and rewrite it and then start up logstash it reads the file.
If I have previously read the file, then when logstash starts it
doesn't read the file despite being told to start at beginning.
Am I missing something here? Is this intended behavior or a possible
bug?
This is the intended behavior and documented at
"This option only modifies 'first contact' situations where
a file is new and not seen before. If a file has already
been seen before, this option has no effect."
If you want to force Logstash to reprocess a file, delete
the corresponding sincedb file (or entry within such a file).
For testing purposes it's much more convenient to use the
stdin input.
Next time, please post Logstash questions like this one to the
logstash-users list.
--
Magnus Bäck | Software Engineer, Development Tools
magnus.back@sonymobile.com | Sony Mobile Communications
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/20150504064649.GA19365%40seldlx20533.corpusers.net.
For more options, visit https://groups.google.com/d/optout.