Can't parse Linux OS generated log files in windows environment with file input plugin

Elastic Stack Logstash
1

Any one ran into this problem:
log files generated by a Linux system which is stored as *.log, can not be parsed in windows environment.

Specifically, I have my logstash conf to read *.log files in a folder: the Linux OS generated ones could not be parsed, and the windows can.
I then tried to copy paste contents in the Linux generated log files in a new txt file and then it worked.

I can't figure out why. Does anyone know? Thanks!

My conf file is as follows:
input {
stdin {}
file {
path => "C:/1LOGS/test1/data//file.log"
start_position => beginning
}
}

output {
stdout {
codec => rubydebug
}
}

2

Check this out:

https://www.elastic.co/guide/en/logstash/current/plugins-codecs-plain.html

Add a charset to the plain codec on your input filter:

input {
  stdin {}
   file {
       path => "C:/1LOGS/test1/data/*/file*.log"
       start_position => beginning
       codec => plain {
           charset => '????'
      }
   }
}

Replace the ???? with a character set that is appropriate for your input file.

3

Thanks for the detailed reply.

It turns out the cause to my problem is the fact that my log files are too old. The post I stumbled into helped:

As @Wayne_Taylor pointed out, the file plugin seems to have a default setting to not read any log events that are more than 24 hours old.

Is there any way to work around it?

Thanks!

4

Take a look at this:

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html

I think you need the ignore_older option, which should allow you to set a value less than the default 24 hours.