Command line works, service does not

I have a very simple config that should produce tons of output:

input {
  file {
    path => "/var/log/glusterfs/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
output {
	stdout { codec => rubydebug }

When running from command line it does, when running as a service it does not.

I've enabled debugging in the conf file, but all I get is this:

[2017-10-05T17:03:17,276][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline
[2017-10-05T17:03:21,386][DEBUG][logstash.inputs.file     ] _globbed_files: /var/log/glusterfs/*.log: glob is: ["/var/log/glusterfs/glustershd.log", "/var/log/glusterfs/test.log", "/var/log/glusterfs/cli.log", "/var/log/glusterfs/glusterd.log", "/var/log/glusterfs/events.log", "/var/log/glusterfs/cmd_history.log"]
[2017-10-05T17:03:22,276][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline
[2017-10-05T17:03:27,275][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline

But no output to stdout (same for file or gelf or any other output).

Edit: I narrowed it down a little bit more: When running this line

/usr/share/logstash/bin/logstash -f glusterfs.conf --path.settings etc/logstash

.... as root it works. When running the same line as user logstash it does not work. I have set "log.level: trace" in logstash.yml, but no errors or warnings show in the logfile.

Does the logstash user have read access to the log files?

Yes. Out of desperation I even changed it to 777 - still not working.

I'd be happy if Logstash would give me a hint why it's not working :wink:

What can I do to get more information (log.level is already at "trace")?

[Edit] What I don't understand is why the files are not discovered. I mean I see lines like this:

_globbed_files: /var/log/glusterfs/*.log: glob is: ["/var/log/glusterfs/glustershd.log", "...

But no lines like this:

_discover_file: /var/log/glusterfs/*.log: new: /var/log/glusterfs/glustershd.log
_discover_file: /var/log/glusterfs/*.log: new: /var/log/glusterfs/cli.log

When using stdout with a service, you will need to find where the stdout gets logged. For example for systemD based Linux distro's you can find it via journalctl.

journalctl -r -u logstash

or to tail it:

journalctl -f -u logstash

I am not using a service with stdout. I run logstash from a command line (at least for testing). One time as user root (working), one time as user logstash (not working)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.