File input in read mode not deleting the file after parsing

Elastic Stack Logstash
1
  • Version: logstash-input-file (4.1.6)
  • Operating System: logstash 6.4.1 image (container)
  • Config File:
    input {
    file {
    id => "client-files"
    mode => "read"
    path => [ "/usr/share/logstash/plugins/message/*.gz"]
    add_field => {"[@metadata][test]" => "test"}
    start_position => "beginning"
    codec => "json"
    file_completed_action => "delete"
    }
    }
    output {
    stdout {codec => rubydebug}
    elasticsearch {
    id => "file-data"
    hosts => [ "elasticsearch:9200" ]
    manage_template => false
    template_name => "test"
    index => "test"
    }
    }
  • Steps to Reproduce:
    i am able to parse data to elasticsearch but the file remains as it's in the folder. Thus when i restart the logstash it reads the file again .
    i am using Kubernetes pods to run logstash.

Please advise if i am missing any configuration.

2

File permission issue was there for which logstash was unable to delete the files from that folder. Now its working fine.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.