# Cannot read input from file using Logstash

**URL:** https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329
**Category:** Logstash
**Created:** [June 2, 2020, 12:11pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329 "2020-06-02T12:11:35Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![NITISH\_GUPTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nitish_gupta/32/69567_2.png) [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)
#### Post date: [June 2, 2020, 12:11pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/1 "2020-06-02T12:11:35Z")

</div>

Logstash is successfully starting and running but there is no update on the elasticsearch cluster. I also tried output to stdout but nothing was displayed.  
Below is the following config file of logstash.

```auto
input {
 	file {
 		path => ["C:\Users\nitis\Downloads\sample.log"]
 		start_position => "beginning"
 	}
 	
 }

 output
 {
  elasticsearch {
 	hosts => ["http://localhost:9200"]
 	index => "testindex2"
 	}	
 }

```

Request for help.

---

<div class="post-metadata">

### Author: ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 2, 2020, 12:57pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/2 "2020-06-02T12:57:05Z")

</div>

is the file read by logstash updated ?

there is a [sincedb\_path](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path) that keep tracks the file reading, which defaults to /plugins/input/file . you might want to check that file first to see whether logstash has previously read the file

---

<div class="post-metadata">

### Author: ![abrx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abrx/32/43881_2.png) [@abrx](https://discuss.elastic.co/u/abrx)
#### Post date: [June 2, 2020, 1:10pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/3 "2020-06-02T13:10:47Z")

</div>

In addition of the since\_sb check, you should check that logstash user has sufficient permissions to the file AND parents folders (exampe of root:root folder)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 2, 2020, 1:11pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/4 "2020-06-02T13:11:48Z")

</div>

Do not use backslash in the path option of a file input. Use forward slash (or \\).

---

<div class="post-metadata">

### Author: ![NITISH\_GUPTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nitish_gupta/32/69567_2.png) [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)
#### Post date: [June 2, 2020, 1:19pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/5 "2020-06-02T13:19:43Z")

</div>

I have three since\_db files but all are of zero KB.  
What does that mean ?  
And how to resolve this.  
I am new to Elastic stack and just learning to read a log file using logstash and redirecting it to elasticsearch cluster index  
I also tried input from stdin and stored it in an index.  
That worked for me.  
Also I wanted to know , what does the message field of doc displays in case of a file. In stdin , it displayed the inputted text. Please throw some light

---

<div class="post-metadata">

### Author: ![NITISH\_GUPTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nitish_gupta/32/69567_2.png) [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)
#### Post date: [June 2, 2020, 1:22pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/6 "2020-06-02T13:22:21Z")

</div>

Logstash automatically does that.  
So it doesn't matter. I saw that in the logs during startup of logstash

---

<div class="post-metadata">

### Author: ![NITISH\_GUPTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nitish_gupta/32/69567_2.png) [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)
#### Post date: [June 2, 2020, 1:23pm UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/7 "2020-06-02T13:23:12Z")

</div>

And how to check that?

---

<div class="post-metadata">

### Author: ![NITISH\_GUPTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nitish_gupta/32/69567_2.png) [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)
#### Post date: [June 4, 2020, 5:57am UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/8 "2020-06-04T05:57:40Z")

</div>

Hey anyone , please reply and help.

---

<div class="post-metadata">

### Author: ![tamilsweet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilsweet/32/54127_2.png) [@tamilsweet](https://discuss.elastic.co/u/tamilsweet)
#### Post date: [June 4, 2020, 6:04am UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/9 "2020-06-04T06:04:54Z")

</div>

Add stdout to Logstash output to verify if content is read from the file properly. Make sure to start Logstash using -e command line flag.

Ref: [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html)

```auto
output
{
  elasticsearch {
   hosts => ["http://localhost:9200"]
   index => "testindex2"
  }
  stdout { }
}

```

Once you verify that the content are read from file, then you can debug in Elasticsearch side.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2020, 6:04am UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329/10 "2020-07-02T06:04:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
