# File input reading file but not pushing to pipeline

**URL:** <https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401>\
**Category:** Logstash\
**Created:** [January 31, 2017, 5:21pm UTC](https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401 "2017-01-31T17:21:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tglawless](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@tglawless](https://discuss.elastic.co/u/tglawless)\
**Post date:** [January 31, 2017, 5:21pm UTC](https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401/1 "2017-01-31T17:21:22Z")

</div>

I'm having trouble with the file input plugin. It sees new entries in the log file, but those entries are not added to the pipeline. The input looks like:

> input {  
> file {  
> path =\> "/var/journald-json/journald"  
> codec =\> "json\_lines"  
> ignore\_older =\> 0  
> start\_position =\> "beginning"  
> type =\> "journald"  
> }  
> }

The output looks like:

> output {  
> stdout {  
> codec =\> "rubydebug"  
> }  
> }

Logstash starts OK and the input plugin prints new lines to the console when debug is enabled:

> 14:50:52.800 [[main]\<file] DEBUG logstash.inputs.file - Received line {:path=\>"/var/journald-json/journald", :text=\>"{ "\_\_CURSOR" : "s=3f2de3e2349e49c790e4478f5519cdbe;i=484;b=3354a8167f2947e08473856657480d51;m=844e9e98;t=547650a9beec0;x=c35ec1553f505666", "\_\_REALTIME\_TIMESTAMP" : "1485874178813632", "\_\_MONOTONIC\_TIMESTAMP" : "2219744920", "\_BOOT\_ID" : "3354a8167f2947e08473856657480d51", "PRIORITY" : "6", "\_MACHINE\_ID" : "aedd904ac41b4e058ca8cbfc31f7fa6e", "\_HOSTNAME" : "localhost.localdomain", "\_TRANSPORT" : "kernel", "SYSLOG\_FACILITY" : "0", "SYSLOG\_IDENTIFIER" : "kernel", "MESSAGE" : "docker0: port 1(veth1f4cc2f) entered forwarding state", "\_SOURCE\_MONOTONIC\_TIMESTAMP" : "2218188974" }"}  
> 14:50:52.800 [[main]\<file] DEBUG logstash.inputs.file - writing sincedb (delta since last write = 1485874252)

_Note: I've delete the sincedb several times._

The log entries never make it to the output plugin. I don't see any errors in the logs and I can't figure out why it's not working. If I change the input to stdin do something like:

> echo '{ "\_\_CURSOR" : "s=3f2de3e2349e49c790e4478f5519cdbe;i=484;b=3354a8167f2947e08473856657480d51;m=844e9e98;t=547650a9beec0;x=c35ec1553f505666", "\_\_REALTIME\_TIMESTAMP" : "1485874178813632", "\_\_MONOTONIC\_TIMESTAMP" : "2219744920", "\_BOOT\_ID" : "3354a8167f2947e08473856657480d51", "PRIORITY" : "6", "\_MACHINE\_ID" : "aedd904ac41b4e058ca8cbfc31f7fa6e", "\_HOSTNAME" : "localhost.localdomain", "\_TRANSPORT" : "kernel", "SYSLOG\_FACILITY" : "0", "SYSLOG\_IDENTIFIER" : "kernel", "MESSAGE" : "docker0: port 1(veth1f4cc2f) entered forwarding state", "\_SOURCE\_MONOTONIC\_TIMESTAMP" : "2218188974" }' | logstash -f .....

The log entry is processed as I would expect.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2017, 5:21pm UTC](https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401/2 "2017-02-28T17:21:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.