Best way to parse a log folder

Elastic Stack Logstash
1

i have 6 folders,, at the end of the day a new log file is added to each folder, i used logstash file input to parse the old files to logstash
file {

path => "/home/sana/pfe/docker/logs/**/*.log"
type => "syslog"
 start_position => "beginning"
 sincedb_path => "/dev/null" 
 #ignore_older => 0

codec => multiline {
pattern => "^(%{TIMESTAMP_ISO8601})"
negate => true
what => "previous"
}
}
what configuration i should add so logstash bring the new files automatically to elascticsearch whithout this
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --config.reload.automatic

2

Just run Logstash all the time. It'll re-expand all filename patterns periodically (by default every 15 seconds I think) so new files will be picked up automatically.

3

thank you, this is the information i've been looking for

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.