# File plugin not reading files as expected

**URL:** <https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844>\
**Category:** Logstash\
**Created:** [May 12, 2016, 2:10am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844 "2016-05-12T02:10:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![null](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@null](https://discuss.elastic.co/u/null)\
**Post date:** [May 12, 2016, 2:10am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844/1 "2016-05-12T02:10:39Z")

</div>

When set 'sincedb\_path' to '/dev/null' and 'start\_position' to 'beginning', logstash does not parse files as expected, it always start and hangs at output below:  
Settings: Default pipeline workers: 4  
Pipeline main started

in my case, I have a lot of existing logs, but I do not want logstash to monitoring the logs, I just want the logs to be parsed and sent to elastic search and be done with them. In addition, the logs are stored in a external hard drive formatted with NTFS filesystem mounted to Ubuntu.

## heres my log.conf for testing on a single log file:

## input { file { 'type' =\> 'apacheSubdomainlog' 'path' =\> '/home/ubuntuser/logs/asubdomain\_access\_20160219.log' 'start\_position' =\> 'beginning' 'sincedb\_path' =\> '/dev/null' } }

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 12, 2016, 2:11am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844/2 "2016-05-12T02:11:43Z")

</div>

> [@null](#):
>
> in my case, I have a lot of existing logs, but I do not want logstash to monitoring the logs, I just want the logs to be parsed and sent to Elasticsearch and be done with them

Why not cat them into a `stdin` input then?

---

<div class="post-metadata">

**Author:** ![null](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@null](https://discuss.elastic.co/u/null)\
**Post date:** [May 12, 2016, 2:31am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844/3 "2016-05-12T02:31:11Z")

</div>

In a general apache access\_log, an entry may look like this:

> 123.123.123.123 - [www.placeholder.com](http://www.placeholder.com) - [24/Jan/2016:00:00:00 +1100] "GET /favicon.ico HTTP/1.1" 404 213 "-" "-" "-"

but for my purpose, all logs have a name like SubdomainName\_access\_20160218.log:

> 121.121.121.121 - - [19/Feb/2016:23:58:12 +1100] "GET /favicon.ico HTTP/1.1" 404 297

the "[www.placeholder.com](http://www.placeholder.com)" is missing. therefore In order to get the domain name this log is relevant to, I need to use the file plugin and mutate the path of the file into domain name field in my index,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 12, 2016, 5:28am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844/5 "2016-05-12T05:28:44Z")

</div>

If the files are older than a day you need to adjust the file input's `ignore_older` option

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/file-plugin-not-reading-files-as-expected/49844/6 "2017-07-06T04:57:58Z")

</div>