HI ,
My config is below
input {
file {
path => "C:/Anuj/ElasticSearch/DMS_GTX-Process_Archive.log"
start_position => "beginning"
sincedb_path => "C:/dev/null/logdbpath.txt"
sincedb_write_interval => 10
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP :timestamp} GMT %{NUMBER:num} %{USERNAME:Application} User [%{USERNAME :BWuser}] - %{USERNAME :job} [(?[a-zA-Z0-9./\s]+)]:%{GREEDYDATA:Log}" }
}
geoip {
source => "clientip"
i am getting below error weather i use sincedb_path => "C:/dev/null/logdbpath.txt" or remove the sincedb_path in logstash 6.5.4 in window 7
below is the error in console when i do not use sincedb_path
Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: The "sincedb_path" argument must point to a file, received a directory: "/dev/null">, :backtrace=>["C:/Anuj/ElasticSearch/logstash-6.5.4/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:280:in register'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:242:in
register_plugin'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:253:in block in register_plugins'", "org/jruby/RubyArray.java:1734:in
each'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:253:in register_plugins'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:396:in
start_inputs'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:294:in start_workers'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:200:in
run'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:160:in `block in start'"], :thread=>"#<Thread:0x46a0759 run>"}
[2019-02-18T13:48:11,513][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[2019-02-18T13:48:12,433][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
when i use sincedb_path i am getting below error:
Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::File start_position=>"beginning", path=>["C:\\Anuj\\ElasticSearch\\apache-daily-access.log"], id=>"9bcb27f7f5896ab49bb3f04a8e55bf2014c540b984adaa730cc5b1d4c818f56e", sincedb_path=>"/dev/null", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_4ab1ca26-a0af-4af3-938b-e2fcacdae12d", enable_metric=>true, charset=>"UTF-8">, stat_interval=>1.0, discover_interval=>15, sincedb_write_interval=>15.0, delimiter=>"\n", close_older=>3600.0, mode=>"tail", file_completed_action=>"delete", sincedb_clean_after=>1209600.0, file_chunk_size=>32768, file_chunk_count=>140737488355327, file_sort_by=>"last_modified", file_sort_direction=>"asc">", :error=>"The "sincedb_path" argument must point to a file, received a directory: "/dev/null"", :thread=>"#<Thread:0x345380c7 run>"}
[2019-02-18T12:02:31,119][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: The "sincedb_path" argument must point to a file, received a directory: "/dev/null">, :backtrace=>["C:/Anuj/ElasticSearch/logstash-6.5.4/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:280:in register'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:242:in
register_plugin'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:253:in block in register_plugins'", "org/jruby/RubyArray.java:1734:in
each'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:253:in register_plugins'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:396:in
start_inputs'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:294:in start_workers'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:200:in
run'", "C:/Anuj/ElasticSearch/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:160:in `block in start'"], :thread=>"#<Thread:0x345380c7 run>"}
[2019-02-18T12:02:31,152][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}