# File input not working - again

**URL:** <https://discuss.elastic.co/t/file-input-not-working-again/31773>\
**Category:** Logstash\
**Created:** [October 7, 2015, 1:13pm UTC](https://discuss.elastic.co/t/file-input-not-working-again/31773 "2015-10-07T13:13:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabio\_Rocha](https://avatars.discourse-cdn.com/v4/letter/f/47e85d/32.png) [@Fabio\_Rocha](https://discuss.elastic.co/u/Fabio_Rocha)\
**Post date:** [October 7, 2015, 1:13pm UTC](https://discuss.elastic.co/t/file-input-not-working-again/31773/1 "2015-10-07T13:13:20Z")

</div>

Hello folks,

I've got issues when tried to read syslog-ng files with file input. It simply doesn't work. Here is my config:

```
    input {
            file {
                    path => ["/var/log/10-SWITCH/*"]
                    sincedb_path => "/var/log/logstash/sincedb"
                    type => "syslog"
                    tags => ["SWITCH"]
            }
    }

    filter {
            if [type] == "syslog" {
                    grok {
                            patterns_dir => "/opt/logstash/patterns"
                            match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
                            add_field => ["received_at", "%{@timestamp}"]
                            add_field => ["received_from", "%{host}"]
                    }
                    syslog_pri { }
                    date {
                            match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
                    }
            }
    }

output {
    elasticsearch {
        host => localhost
        embedded => true
    }
    stdout { codec => rubydebug }
}

```

I tried:

- Delete sincedb files, including those located at $HOME/.sincedb
- Set sincedb\_path to /dev/null
- Set start\_position to beginning
- Set root:root owner/group to logs dir

None of above worked.

Use a socket (i.e.: input { tcp { port =\> 5514 } } } ) as input is an option, but I can't figure out a way to filter in origin the several different types of logs collected (firewalls, windows, linux process, wi-fi controllers, switches, routers and so on). I cannot do many changes to syslog-ng configuration, like listening port for exemple.

May some help with this issue?

Regards!

Fábio

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 7, 2015, 1:29pm UTC](https://discuss.elastic.co/t/file-input-not-working-again/31773/2 "2015-10-07T13:29:39Z")

</div>

Increase Logstash's logging verbosity with `--verbose` and inspect the logs. My hunch is that you don't have sufficient permissions to read the log files.

> - Set root:root owner/group to logs dir

How would this help? Are you running Logstash as root?

> Use a socket (i.e.: input { tcp { port =\> 5514 } } } ) as input is an option, but I can't figure out a way to filter in origin the several different types of logs collected (firewalls, windows, linux process, wi-fi controllers, switches, routers and so on).

Why would this be more difficult if you're receiving the logs over the network rather than by reading local files? How are you currently distinguishing the different messages?

---

<div class="post-metadata">

**Author:** ![Fabio\_Rocha](https://avatars.discourse-cdn.com/v4/letter/f/47e85d/32.png) [@Fabio\_Rocha](https://discuss.elastic.co/u/Fabio_Rocha)\
**Post date:** [October 7, 2015, 2:05pm UTC](https://discuss.elastic.co/t/file-input-not-working-again/31773/3 "2015-10-07T14:05:02Z")

</div>

You got it Magnus!

Permission issue, I set read flag to group and group ownership to logstash in logs dir. Everything is working now!

Thanks!

Best regards!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/file-input-not-working-again/31773/4 "2017-07-06T05:27:12Z")

</div>

Closed on July 6, 2017, 5:27am UTC