# Input plugin 'file' issue **URL:** \ **Category:** Elasticsearch\ **Created:** [November 21, 2013, 5:56am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508 "2013-11-21T05:56:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [November 21, 2013, 5:56am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/1 "2013-11-21T05:56:16Z")
I want to push tomcat logs into elastic search My config file is input { stdin { type =\> "stdin-type" } file { type =\> "weblog" ``` # Wildcards work, here :) path => D:\tomcatlog.log ``` } } output { stdout { } elasticsearch { embedded =\> true } } When i run logstash it shows following message and no logs are getting in elastic search ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin mi lestones, see [http://logstash.net/docs/1.2.2/plugin-milestones](http://logstash.net/docs/1.2.2/plugin-milestones) {:level=\>:warn}←[ 0m Any solution to above problem? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [November 21, 2013, 8:29am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/2 "2013-11-21T08:29:29Z")
Just wondering if you should not double backslash chars: path =\> D:\tomcatlog.log Or something similar? Does it help? -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr Le 21 novembre 2013 at 06:56:20, abhi patel ([abhiage@gmail.com](mailto:abhiage@gmail.com)) a écrit: I want to push tomcat logs into elastic search My config file is input { stdin { type =\> "stdin-type" } file { type =\> "weblog" ``` # Wildcards work, here :) path => D:\tomcatlog.log ``` } } ## output { stdout { } elasticsearch { embedded =\> true } } When i run logstash it shows following message and no logs are getting in elastic search ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin mi lestones, see [http://logstash.net/docs/1.2.2/plugin-milestones](http://logstash.net/docs/1.2.2/plugin-milestones) {:level=\>:warn}←[ 0m Any solution to above problem? You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [November 21, 2013, 11:43am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/3 "2013-11-21T11:43:54Z")
I guess its not an error its just a warning regarding plugin mile stone. I think path syntax is the concern.is it? On Thursday, November 21, 2013 1:59:29 PM UTC+5:30, David Pilato wrote: > Just wondering if you should not double backslash chars: > > path =\> D:\tomcatlog.log > > Or something similar? > > Does it help? > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > Le 21 novembre 2013 at 06:56:20, abhi patel ([abh...@gmail.com](mailto:abh...@gmail.com)\) > a écrit: > > I want to push tomcat logs into Elasticsearch > > My config file is > > input { > stdin { > type =\> "stdin-type" > } > > file { > type =\> "weblog" > > ``` > # Wildcards work, here :) > path => D:\tomcatlog.log > > ``` > > } > } > > output { > stdout { } > elasticsearch { embedded =\> true } > } > > When i run logstash it shows following message and no logs are getting in > Elasticsearch > > ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, > but if > you see strange behavior, please let us know! For more information on > plugin mi > lestones, see [Logstash: Collect, Parse, Transform Logs | Elastic](http://logstash.net/docs/1.2.2/plugin-milestones) > {:level=\>:warn}←[ > 0m > > ## Any solution to above problem? > > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [November 21, 2013, 11:46am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/4 "2013-11-21T11:46:34Z")
I have tried what you suggested but it is showing error that only absolute path should be mentioned. On Thursday, November 21, 2013 1:59:29 PM UTC+5:30, David Pilato wrote: > Just wondering if you should not double backslash chars: > > path =\> D:\tomcatlog.log > > Or something similar? > > Does it help? > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > Le 21 novembre 2013 at 06:56:20, abhi patel ([abh...@gmail.com](mailto:abh...@gmail.com)\) > a écrit: > > I want to push tomcat logs into Elasticsearch > > My config file is > > input { > stdin { > type =\> "stdin-type" > } > > file { > type =\> "weblog" > > ``` > # Wildcards work, here :) > path => D:\tomcatlog.log > > ``` > > } > } > > output { > stdout { } > elasticsearch { embedded =\> true } > } > > When i run logstash it shows following message and no logs are getting in > Elasticsearch > > ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, > but if > you see strange behavior, please let us know! For more information on > plugin mi > lestones, see [Logstash: Collect, Parse, Transform Logs | Elastic](http://logstash.net/docs/1.2.2/plugin-milestones) > {:level=\>:warn}←[ > 0m > > ## Any solution to above problem? > > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [November 21, 2013, 11:49am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/5 "2013-11-21T11:49:24Z")
Try with d:/tomcatlog.log I guess it should work. > Le 21 novembre 2013 à 12:46, abhi patel [abhiage@gmail.com](mailto:abhiage@gmail.com) a écrit : > > I have tried what you suggested but it is showing error that only absolute > path should be mentioned. > > On Thursday, November 21, 2013 1:59:29 PM UTC+5:30, David Pilato wrote: > > > > Just wondering if you should not double backslash chars: > > > > ``` > > > > > > > > > ``` > > > > > ``` > > > path => D:\\tomcatlog.log > > > > > > ``` > > > > > > > > Or something similar? > > > > Does it help? > > > > -- > > David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) > > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr > > [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > > > Le 21 novembre 2013 at 06:56:20, abhi patel ([abh...@gmail.com](mailto:abh...@gmail.com)) a écrit: > > > > ``` > > > > > > > > > ``` > > > > > ``` > > > I want to push tomcat logs into elastic search > > > > > > My config file is > > > > > > input { > > > stdin { > > > type => "stdin-type" > > > } > > > > > > file { > > > type => "weblog" > > > > > > # Wildcards work, here :) > > > path => D:\tomcatlog.log > > > } > > > } > > > > > > output { > > > stdout { } > > > elasticsearch { embedded => true } > > > } > > > > > > When i run logstash it shows following message and no logs are > > > > > > ``` > > > > > > getting in Elasticsearch > > > > > > ``` > > > ←[33mUsing milestone 2 input plugin 'file'. This plugin should be > > > > > > ``` > > > > > > stable, but if > > > you see strange behavior, please let us know! For more information > > > on plugin mi > > > lestones, see [http://logstash.net/docs/1.2.2/plugin-milestones](http://logstash.net/docs/1.2.2/plugin-milestones) > > > {:level=\>:warn}←[ > > > 0m > > > > > > ``` > > > Any solution to above problem? > > > -- > > > You received this message because you are subscribed to the Google > > > > > > ``` > > > > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, > > > send an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > For more options, visit[https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out) . > > > > > > > > > > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit[https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out) . -- David Pilato [http://www.scrutmydocs.org/](http://www.scrutmydocs.org/) [http://dev.david.pilato.fr/](http://dev.david.pilato.fr/) Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Andrej](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Andrej](https://discuss.elastic.co/u/Andrej)\ **Post date:** [November 21, 2013, 11:50am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/6 "2013-11-21T11:50:57Z")
First, you could set start\_position to beginning, by default its end and you will only see logs new in the file. Second, you should look out for the .sinceDB file (remove it or set it to something like /dev/null), otherwise logstash remebers the last position in the file and will not reprocess it again. Greets, Andrej Am Donnerstag, 21. November 2013 12:46:34 UTC+1 schrieb abhi patel: > I have tried what you suggested but it is showing error that only absolute > path should be mentioned. > > On Thursday, November 21, 2013 1:59:29 PM UTC+5:30, David Pilato wrote: > > > Just wondering if you should not double backslash chars: > > > > path =\> D:\tomcatlog.log > > > > Or something similar? > > > > Does it help? > > > > -- > > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > > > Le 21 novembre 2013 at 06:56:20, abhi patel ([abh...@gmail.com](mailto:abh...@gmail.com)) a écrit: > > > > I want to push tomcat logs into Elasticsearch > > > > My config file is > > > > input { > > stdin { > > type =\> "stdin-type" > > } > > > > file { > > type =\> "weblog" > > > > ``` > > # Wildcards work, here :) > > path => D:\tomcatlog.log > > > > ``` > > > > } > > } > > > > output { > > stdout { } > > elasticsearch { embedded =\> true } > > } > > > > When i run logstash it shows following message and no logs are getting > > in Elasticsearch > > > > ←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, > > but if > > you see strange behavior, please let us know! For more information on > > plugin mi > > lestones, see [Logstash: Collect, Parse, Transform Logs | Elastic](http://logstash.net/docs/1.2.2/plugin-milestones) > > {:level=\>:warn}←[ > > 0m > > > > ## Any solution to above problem? > > > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:05am UTC](https://discuss.elastic.co/t/input-plugin-file-issue/14508/7 "2017-07-06T02:05:41Z")