Hi,
So I am using logstash to push data to elasticsearch. For backup we are writing the same logs into a file databakup.log. For this we are using gzip true as below:
output{
file {
path => "/home/ubuntu/logstash-filelogs/logstash-%{+YYYY-MM-dd}.log"
gzip => true
}
}
Now I want to read this file in case of elasticsearch goes down. The problem I am facing is that the file input doesn't recognise the format. Below is my config
input{
file {
path => "/home/ubuntu/logstash-filelogs/*"
start_position => "beginning"
codec => gzip_lines
type => "gzip"
mode => "read"
}
}
Can you please help me understand what I am missing here?