File input plugin is not working


(Ibrahim Sharaf El Den) #1

Hello everyone, I am trying to use file input plugin instead of tcp, but it doesn't work (there are no injected files in elasticsearch), here's a minimal configuration for logstash:

input {
    file {
        path => ["/home/ibrahimsharaf/docker-elk/logs/**/*.log"]
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => previous
        }
        sincedb_path => "/dev/null"
        start_position => "beginning"
    }
}

output {
		stdout {
			codec => rubydebug
		}
		elasticsearch {
			hosts => "elasticsearch:9200"
		}
}

(Magnus Bäck) #2

Comment out the elasticsearch output while you're debugging and focus on what you get from the stdout output. What happens if you comment out the multiline codec? What does an example log line look like?


(Ibrahim Sharaf El Den) #3

It turned out to be an installation rather than configurations problem, thanks @magnusbaeck.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.