Logstash is a streaming processor. There is no way for it to keep state on a line from the beginning of a file using only the
You may wonder why this is so. The answer is particularly that Logstash isn't programmed to know if it's going to only ever ready one file. It's designed to keep reading from new files in a location, even if you specify a single-named file. What if that file keeps the same name, but is rotated by some other process? Logstash can't know that. As a result, there's simply no way using the
file input plugin to read headers from the first line of a file and keep them for use later on in the stream.
There have been some efforts made by some users to write a csv input plugin to accomplish this, as csv files frequently have a header line for this same purpose. I'm not sure where those efforts are hosted, or if you can find them. My point is that what you're seeking requires a dedicated input plugin, and cannot be otherwise accomplished using the