# Intermittent issue while resolving symlinks to real path

**URL:** <https://discuss.elastic.co/t/intermittent-issue-while-resolving-symlinks-to-real-path/70670>\
**Category:** Logstash\
**Created:** [January 5, 2017, 11:04am UTC](https://discuss.elastic.co/t/intermittent-issue-while-resolving-symlinks-to-real-path/70670 "2017-01-05T11:04:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ld\_pvl](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\
**Post date:** [January 5, 2017, 11:04am UTC](https://discuss.elastic.co/t/intermittent-issue-while-resolving-symlinks-to-real-path/70670/1 "2017-01-05T11:04:21Z")

</div>

Hi,

In our environment, we have multiple logs folders. There's a symlink that points to a currently active logs folder and this symlink constantly changes pointing to a different folder. Something like this:

logs\_a/  
logs\_b/  
current -\> logs\_c/  
logs\_d/

I was trying to be "clever" and instead of using a wildcard to just consider all the folders regardless of the symlink, I instead set up the file path to be looking at the symlink because I know Logstash works well with symlinks even when they change (I tested it)

file {  
path =\> "/some/path/current/some.log"  
...  
}

Now one challenge I had was I wanted the event to show the real path as well besides the symlink path so I have been using the ruby code below which I just found out doesn't work 100% of the time but returns a wrong real path sometimes and by wrong I mean it resolve the real path to an incorrect logs folder. I suspect maybe when Logstash was still parsing stuff the symlink changed by the time ruby code was executed.

ruby {  
code =\> "event.set('real\_path', File.real\_path(event.get('path')))"  
}

So my question is what do you think is causing the problem here?

And do you think using Ruby code to get the real path is a good way?

Or should I just use the wild card way to listen to all the folders instead?

Many thanks for your help,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2017, 11:04am UTC](https://discuss.elastic.co/t/intermittent-issue-while-resolving-symlinks-to-real-path/70670/2 "2017-02-02T11:04:45Z")

</div>

Closed on February 2, 2017, 11:04am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.