# Error de salida con Logstash

**URL:** <https://discuss.elastic.co/t/error-de-salida-con-logstash/101246>\
**Category:** Elastic en Español\
**Created:** [September 20, 2017, 11:20pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246 "2017-09-20T23:20:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Erick\_Garcia\_Perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erick_garcia_perez/32/22244_2.png) [@Erick\_Garcia\_Perez](https://discuss.elastic.co/u/Erick_Garcia_Perez)\
**Post date:** [September 20, 2017, 11:20pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/1 "2017-09-20T23:20:59Z")

</div>

Buenas tardes, alguien que me diga como trabajar con logs remotos apoyado de rsync junto con logstash, ando trabajando con logstash y logs remotos pero a la hora de insertar un registro en un log, la salida(output) de logstash me muestra dos veces el registro o se pone a leer todo el archivo desde el inicio

---

<div class="post-metadata">

**Author:** ![gmoskovicz](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)\
**Post date:** [September 22, 2017, 12:27pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/2 "2017-09-22T12:27:34Z")

</div>

Hola @Erick_Garcia_Perez!

Cual es la configuracion de Logstash que estas utilizando? Alguna chances de que logrotate o algun programa este modificando el archivo?

Saludos!

---

<div class="post-metadata">

**Author:** ![Erick\_Garcia\_Perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erick_garcia_perez/32/22244_2.png) [@Erick\_Garcia\_Perez](https://discuss.elastic.co/u/Erick_Garcia_Perez)\
**Post date:** [September 22, 2017, 5:04pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/3 "2017-09-22T17:04:48Z")

</div>

Hola esta es mi configuracion para logstash  
input {  
file{  
path =\> "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log\_aceso/accesso"  
type =\> "access"  
#sincedb\_path =\>"/dev/null"  
}  
file{  
path =\> "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log\_aceso/accesso2"  
type =\> "access"  
#sincedb\_path =\>"/dev/null"  
}  
file{  
path =\> "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log\_error/error"  
type =\> "errorapa"  
#sincedb\_path =\> "/dev/null"  
}  
file{  
path =\> "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log\_mysql/mysql"  
type =\> "mysql\_error"  
}  
file{  
path =\> "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/tomcat\_catalina\_out/tomcatcatalinaout"  
type =\> "tomcat"  
codec =\> multiline {  
pattern =\> "^%{DATA:day} %{DATA:DAY}, %{DATA:year} %{HOUR}:%{MINUTE}:%{SECOND} (?:AM|PM) "  
negate =\> true  
what =\> "previous"  
}  
#sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
if [type] in ["apache","apache\_access","apache-access","access"] {  
grok {  
match =\> ["message","%{IP:clientip} - - %{GREEDYDATA}"]  
}  
}  
}  
filter{  
if [type] in ["errorapa"] {  
grok {  
match =\> ["message","%{GREEDYDATA}"]  
}  
}

}

filter {  
#Deal with the multi-line MySQL/MariaDB log entries  
if [type] in ["mysql\_error"] {  
grok {  
match =\> ["message","%{GREEDYDATA:message}"]  
}  
}  
}  
filter {  
if [type] in ["tomcat"]{  
grok {  
match =\> ["message", "%{DATA:day} %{DATA:DAY}, %{DATA:year} %{HOUR}:%{MINUTE}:%{SECOND} (?:AM|PM)"]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![gmoskovicz](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)\
**Post date:** [September 22, 2017, 7:26pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/4 "2017-09-22T19:26:31Z")

</div>

> [@Erick\_Garcia\_Perez](#):
>
> sincedb\_path =\> "/dev/null"

Eso queria corroborar. Esto seria lo unico que podria hacer que logstash lea de vuelta los documentos. La otra opcion es que esten borrando el sincedb por algun motivo. Si eso sucede tambien puede pasar que Logstash "se olvide" de donde estaba leyendo y lo lea nuevamente. De otra forma al tener solo un Elasticsearch output no deberias de tener problemas.

Saludos!

---

<div class="post-metadata">

**Author:** ![Erick\_Garcia\_Perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erick_garcia_perez/32/22244_2.png) [@Erick\_Garcia\_Perez](https://discuss.elastic.co/u/Erick_Garcia_Perez)\
**Post date:** [September 22, 2017, 9:17pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/5 "2017-09-22T21:17:15Z")

</div>

Gracias, y como corroboro que no se este borrando el sincedn?

---

<div class="post-metadata">

**Author:** ![gmoskovicz](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)\
**Post date:** [September 25, 2017, 12:49pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/6 "2017-09-25T12:49:36Z")

</div>

En la carpeta data se crea por defecto esto. Si no estan tocando la carpeta data, entonces no deberia estar sucediendo esto:

> Path of the sincedb database file (keeps track of the current position of monitored log files) that will be written to disk. The default will write sincedb files to \<path.data\>/plugins/inputs/file NOTE: it must be a file path and not a directory path

Saludos !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 12:49pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246/7 "2017-10-23T12:49:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.