running logstash on RHEL 7 (logstash -2.2.1-1 / java-1.8.0-openjdk) and a very simple configuration:
more /etc/logstash/conf.d/*
::::::::::::::
/etc/logstash/conf.d/10-input-messages
::::::::::::::
input {
file {
type => "linuxsyslog"
path => "/BD/disk7/messages"
sincedb_path => "/APPL/.sincedb_linux_messages2"
start_position => "beginning"
}
}
::::::::::::::
/etc/logstash/conf.d/90-output-stdout
::::::::::::::
output {
stdout { codec => rubydebug { metadata => true } }
}
No output from the inputfile message:
/opt/logstash/bin/logstash -f /etc/logstash/conf.d/ -w 2 -v
Settings: User set pipeline workers: 2, Default pipeline workers: 24
Registering file input {:path=>["/BD/disk7/messages"], :level=>:info}
Starting pipeline {:id=>"base", :pipeline_workers=>2, :batch_size=>125, :batch_delay=>5, :max_inflight=>250, :level=>:info}
Pipeline started {:level=>:info}
Logstash startup completed
--- no file output---
I copied input file "/BD/disk7/messages" to "/BD/disk7/mess7" , changed that in 10-input-messages, and the logstash output was as expected:
/opt/logstash/bin/logstash -f /etc/logstash/conf.d/ -w 2 -v
Settings: User set pipeline workers: 2, Default pipeline workers: 24
Registering file input {:path=>["/BD/disk7mess7"], :level=>:info}
Starting pipeline {:id=>"base", :pipeline_workers=>2, :batch_size=>125, :batch_delay=>5, :max_inflight=>250, :level=>:info}
Pipeline started {:level=>:info}
Logstash startup completed
{
"message" => ...
....
.sincedb content:
0 0 0 0
12 0 2161 1144
ls -lai /BD/disk7/mess*
12 -rwxr-x--- 1 root root 1144 Feb 16 09:05 /BD/disk7/mess7
75497942 -rwxrwxrwx 1 root root 1144 Feb 2 21:00 /BD/disk7/messages
Looks like a problem with the quite high inode number of the file "messages", but its only a 2TB filesystem.
df -HT | grep /BD/disk7
/dev/sdh1 ext4 2.3T 11G 2.3T 1% /BD/disk7