# Get data from different servers with PATH command in logstash? **URL:** \ **Category:** Logstash\ **Created:** [May 13, 2017, 11:46am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641 "2017-05-13T11:46:45Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 13, 2017, 11:46am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/1 "2017-05-13T11:46:45Z")
Hi, I have my ES cluster in 3 nodes(i.e.Each node in each VM) , i had enabled the slowlogs in all the node and keep slowlogs in the PATH: `/var/es/slowlogs.log` . So , what i had did is i writtten a logstash script to parse the logs that are taking \> 15ms . Scenario: 1. I need to run the logstash script in cron job in such a way it will give all the logs to me at prescribed time. For that i had installed logstash in NODE1 and kept the input path as What i want is, How can i get all the slowlogs that are present in all the VM's at one shot than running the same script in all the VM's([i.e.In](http://i.e.In) a node 1 if i run the script it will get the parsed data from all the three nodes some thing like this `path => "/var/es/all node logs.log"` SO that i will get the all parsed data from all the logs in all VM's Is this possible in logstash ? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 14, 2017, 8:29pm UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/2 "2017-05-14T20:29:03Z")
> I need to run the logstash script in cron job in such a way it will give all the logs to me at prescribed time. I suggest you run Logstash all the time and process the logs continuously. Better results and easier to set up. > How can i get all the slowlogs that are present in all the VM's at one shot than running the same script in all the VM's Logstash's file input can only read files in locally mounted file systems, i.e. you'd have to make the log files on the other machines available via e.g. NFS. This isn't recommended. I suggest you either - use Filebeat to ship the log files to a single Logstash server, or - run Logstash on all ES servers. ---
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 15, 2017, 10:40am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/3 "2017-05-15T10:40:23Z")
Thanks @magnusbaeck[quote="magnusbaeck, post:2, topic:85641"] I suggest you run Logstash all the time and process the logs continuously [/quote] How can i run the logstash all the time ? Problem: Because if i run the logstash script once it is producing one .sincedb\* file , so if i am running it again i need to delete the .sincedb\* file and run it again then only it is working correctly. > [@magnusbaeck](#): > > use Filebeat to ship the log files to a single Logstash server Once filebeat is configured properly & enabled it will automatically transfer the logs to single logstash server right? Or i have to run it manually to do that? Any suggestions on these? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 15, 2017, 10:58am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/4 "2017-05-15T10:58:33Z")
> Because if i run the logstash script once it is producing one .sincedb\* file , so if i am running it again i need to delete the .sincedb\* file and run it again then only it is working correctly. This is only necessary if you want to process the exact same file again, but that should be a highly unusual use case. > Once filebeat is configured properly & enabled it will automatically transfer the logs to single logstash server right? Yes, that's what it does. ---
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 15, 2017, 11:06am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/5 "2017-05-15T11:06:02Z")
> [@magnusbaeck](#): > > This is only necessary if you want to process the exact same file again, but that should be a highly unusual use case. But this is happening every time when i am running the same config file again . > [@magnusbaeck](#): > > I suggest you run Logstash all the time and process the logs continuously. Better results and easier to set up. How can i run the logstash all the time ? Because normally we will run the config file like this `logstash -f config.conf` manually every time to run the logstash Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 15, 2017, 11:58am UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/6 "2017-05-15T11:58:10Z")
> But this is happening every time when i am running the same config file again . You mean Logstash is processing the same file over and over again? If so it sounds like Logstash is having problems saving the sincedb file, or the file you're reading is updated in a weird way. Are you modifying the source log file in any way between each run? > How can i run the logstash all the time ? Run it as a service. This is described in the documentation. ---
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 15, 2017, 12:21pm UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/7 "2017-05-15T12:21:33Z")
I have a logstash config file when i run it for the first time it is working fine and produces a sincedb file. If i run the same config file again it will not show any output it remains in blinking state without out showing any output , but if i delete the sincedb file and run it again then it is working fine. Do i have to delete the sincedb file everytime when running the same config logstash file? > [@magnusbaeck](#): > > Run it as a service In [documentation](https://www.elastic.co/guide/en/logstash/current/running-logstash.html) they didnt mentioned how to run as a service in windows. Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 15, 2017, 12:36pm UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/8 "2017-05-15T12:36:44Z")
In _Windows_? Since /var/es/slowlogs.log is the file you want to read I assumed this was non-Windows. I don't know how this is done on Windows. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 15, 2017, 1:10pm UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/9 "2017-05-15T13:10:22Z")
I can help you to run as a service on Windows as it's what I've done: > **[Installing the ELK Stack on Windows - Logz.io](https://logz.io/blog/installing-the-elk-stack-on-windows/)** > > This tutorial provides a step-by-step guide to installing the ELK Stack (Elasticsearch, Logstash and Kibana) as services on Windows Server 2012. It says to use Powershell to run nssm, but you can simply launch it in command line: nssm install MyServiceName and then configure it. Here a small recap that I've made on my PC: ```auto * Open a Shell * Go where nssm.exe is * Type: nssm install Logstash * A GUI will appear: * On application tab: * Path: C:\elk\logstash\bin\logstash.bat (in my case) * Startup directory: C:\elk\logstash\bin * Arguments: -f c:\elk\logstash\config\logstash.conf -r * If you have multiple .conf files, you can do *.conf to include them all * -r make Logstash wary of changes in conf files and restart to apply them will not be necessary anymore * On Details tab: * Display name: Logstash * Description: Logstash Service * Startup type: Automatic * On Dependencies tab (not mandatory) * set: elasticsearch-service-x64 (or whatever elasticsearch service name was) * You can now click on Install Service * If you need to modify the service later, type on a shell: nssm modify Logstash ``` for nssm: [https://nssm.cc/](https://nssm.cc/) As for you sincedb "problem", on your input file plugin, add: `sincedb_path => "NUL"` (for Windows) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2017, 1:25pm UTC](https://discuss.elastic.co/t/get-data-from-different-servers-with-path-command-in-logstash/85641/10 "2017-06-12T13:25:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.