I have a config that reads a folder in linux, issue is logstash always reads from beginning for each modification, After first successful run I add a log entry to the file, logstash reads from beginning instead of reading only the last entry. I removed sincedb files no luck, any help is appreciated
input {
file {
path => "/home/gsgokul/working/logs/*"
start_position => "beginning"
}
}
filter {
grok {
patterns_dir => ["/home/gsgokul/working/patterns"]
match => { "message" => "%{IDENTIFI_LOG}"}
}
date {
match => ["logdate", "YYYY-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
stdout { codec => rubydebug }
}