# How to set Logstash to parse logfile as soon as logfile has new data

**URL:** <https://discuss.elastic.co/t/how-to-set-logstash-to-parse-logfile-as-soon-as-logfile-has-new-data/71845>\
**Category:** Logstash\
**Created:** [January 17, 2017, 10:36am UTC](https://discuss.elastic.co/t/how-to-set-logstash-to-parse-logfile-as-soon-as-logfile-has-new-data/71845 "2017-01-17T10:36:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sezanawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sezanawa/32/21910_2.png) [@sezanawa](https://discuss.elastic.co/u/sezanawa)\
**Post date:** [January 17, 2017, 10:36am UTC](https://discuss.elastic.co/t/how-to-set-logstash-to-parse-logfile-as-soon-as-logfile-has-new-data/71845/1 "2017-01-17T10:36:10Z")

</div>

Hallo Everybody

I have successfully configured ELK on my local machine. when i run following command, it start sending data to ES for indexing.

```
logstash -f.. \conf\Onsurance.conf --path.settings=file://C:/ELK/logstash/config

```

I want it check after every 30 seconds, either logfiles has new data, so it should send to ES for Indexing.  
How to do that? as per documentation it check after every 15s but it seems like i have some config problem.

Today i have copied logfiles of last week from server. i was expecting Logstash will automatically recognize that it has new logfiles to parse but it has not done anything.

Here is my Config

```
input {
 stdin { }
 file {
   	type => "OnsuranceAppLog"
	path => "D:/logs/main/Api.Ohcp/Onsurance/*ApplicationEntLib*.log"	
    start_position => "beginning" 
	sincedb_path => "NUL"
	ignore_older => 0	
	codec => multiline {
	  pattern => "^%{WORD};"
	  negate => true
	  what => "previous"
	}
   }
}

filter {  
	mutate {
	 gsub => ["message", "\n", " "]
     gsub => ["message", "\t", " "]  		 
	}   
	grok {    
		match => ["message", "(?m)%{WORD:LOGLEVEL}\;%{WORD:Machine}\;%{GREEDYDATA:Logtimestamp}\;%{WORD:}\=;%{WORD:}\=;%{WORD:}\=;%{WORD:}\;%{WORD:}\=;%{GREEDYDATA:message}"]		
		overwrite => ["message"]
		add_field => { "ApplicationName" => "Onsurance" } 	
		remove_field => ["WORD"]	
	}
  #Set the Event Timesteamp from the log
  date {	
	match => ["Logtimestamp","dd.MM.yyyy HH:mm:ss,SSS"]		
	remove_field => ["Logtimestamp"]	
  }	 
}

# See documentation for different protocols:
output {
if [type] == "OnsuranceAppLog" {
  elasticsearch { 
  hosts => ["localhost:9200"] 
  index => "onsurance-%{+YYYY.MM.dd}"}  
  } 
  stdout { codec => rubydebug } 
}

```

i am using sincedb\_path="NUL" because currently i am reindexing all logs per command line.

Whats wrong with my config? any idea or solution?

Thanks and regards

---

<div class="post-metadata">

**Author:** ![sezanawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sezanawa/32/21910_2.png) [@sezanawa](https://discuss.elastic.co/u/sezanawa)\
**Post date:** [January 18, 2017, 10:39am UTC](https://discuss.elastic.co/t/how-to-set-logstash-to-parse-logfile-as-soon-as-logfile-has-new-data/71845/2 "2017-01-18T10:39:46Z")

</div>

Hi @magnusbaeck

any idea? or solution?

i ll really greatful for any feedback

regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2017, 10:39am UTC](https://discuss.elastic.co/t/how-to-set-logstash-to-parse-logfile-as-soon-as-logfile-has-new-data/71845/3 "2017-02-15T10:39:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.