Each: active: file expired for #{path} // :timeout for #{path}, closing file

Elastic Stack Logstash
1

Behaviour from user point of view:

I'm currently facing the following issue: logstash sometimes "miss" log files.
When restarting it it parses the file correctly and data are filtered then passed to output plugin.

When switching logstash to debug loglevel, I'm getting this message (repeated thousands times until Logstash is restarted):
[2018-03-27T05:14:48,668][DEBUG][logstash.inputs.file ] each: active: file expired: /myfiolder/logs/my-batch-log-file.log
[2018-03-27T05:14:48,668][DEBUG][logstash.inputs.file ] :timeout for /myfiolder/logs/my-batch-log-file.log, closing file

  • logstash version: 5.5.1-1
  • logstash-input-file: 4.0.2
  • filewatch version: 0.9.0

What I've searched and understood so far:

The message does not belong to logstash code directly but comes from the filewatch ruby gem

I've no idea what is happening here, even by looking inside the filewatch code:

  • it does not look like a Ruby exception
  • it does not look like a logstash input-file plugin wrong behaviour
  • it does not look like a logstash core problem
  • there is no Google results for the debug logs keywords

And so... here I am... asking help or idea from where to start the troubleshooting...

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.