# File paths must be absolute, relative path specified error while running logstash on docker

**URL:** https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704
**Category:** Logstash
**Tags:** docker
**Created:** [April 20, 2021, 12:59pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704 "2021-04-20T12:59:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![pradeep\_gadkari](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)
#### Post date: [April 20, 2021, 12:59pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704/1 "2021-04-20T12:59:51Z")

</div>

I am running ELK stack on docker using deviantony/docker-elk from Github. When I try reading log files from my local machine, logstash stops with error

```auto
[2021-04-20T12:36:43,101][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: C:/logs/xyz/abcd*.log>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.2.3/lib/logstash/inputs/file.rb:283:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.2.3/lib/logstash/inputs/file.rb:281:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:386:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x1431553d run>"}

[2021-04-20T12:36:43,105][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"}

[2021-04-20T12:36:43,119][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

I am using WSL2 based engine in Docker desktop so I do not need to enable file sharing between my localhost and the container. The input section of my logstash conf file is as below

```auto
input {
	file{
		path => "C:/logs/xyz/abcd*.log"
		start_position => 'beginning'
		sincedb_path => "NULL"
# type => "rad_minol"
	}
}

```

My docker-compose file is

```auto
version: '3.2'

services:
  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./elasticsearch/config/elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
        read_only: true
      - type: volume
        source: elasticsearch
        target: /usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx256m -Xms256m"
      ELASTIC_PASSWORD: *****
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk

  logstash:
    build:
      context: logstash/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./logstash/config/logstash.yml
        target: /usr/share/logstash/config/logstash.yml
        read_only: true
      - type: bind
        source: ./logstash/pipeline
        target: /usr/share/logstash/pipeline
        read_only: true
    ports:
      - "5044:5044"
      - "5000:5000/tcp"
      - "5000:5000/udp"
      - "9600:9600"
    environment:
      LS_JAVA_OPTS: "-Xmx256m -Xms256m"
    networks:
      - elk
    depends_on:
      - elasticsearch

  kibana:
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./kibana/config/kibana.yml
        target: /usr/share/kibana/config/kibana.yml
        read_only: true
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

networks:
  elk:
    driver: bridge

volumes:
  elasticsearch:

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 20, 2021, 3:36pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704/2 "2021-04-20T15:36:21Z")

</div>

> [@pradeep\_gadkari](#):
>
> ```auto
> path => "C:/logs/xyz/abcd*.log"
> start_position => 'beginning'
> sincedb_path => "NULL"
> 
> ```

If you do not want the in-memory sincedb persisted across restarts then set sincedb\_path to "NUL". When you set it to "NULL" it is persisted in a file called NULL in the working directory of logstash.

The error message is telling you that [Pathname.relative?](https://github.com/ruby/pathname/blob/bf42057e16092fd8ab12bc9957502d04d6401040/lib/pathname.rb#L246) is returning true. Note that the comment about is just testing for a leading / is nonsense. It tests for a drive letter too, if appropriate.

That said, your docker compose file appears to be building a UNIX filesystem. Your path option refers to a Windows filesystem. That is not valid on a UNIX machine.

---

<div class="post-metadata">

### Author: ![pradeep\_gadkari](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)
#### Post date: [April 21, 2021, 12:40pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704/3 "2021-04-21T12:40:59Z")

</div>

I updated the docker-compose file and added

```auto
      - type: bind
        source: C:/logs/xyz
        target: /logstash/logs/xyz

```

in volumes under logstash

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 19, 2021, 12:41pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704/4 "2021-05-19T12:41:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
