# Logash 1.4.1, Windows Server 2008, Tomcat 7.0.30, stuck with localhost\_access\_log.2014-06-16.txt **URL:** \ **Category:** Elasticsearch\ **Created:** [June 16, 2014, 11:41am UTC](https://discuss.elastic.co/t/logash-1-4-1-windows-server-2008-tomcat-7-0-30-stuck-with-localhost-access-log-2014-06-16-txt/18131 "2014-06-16T11:41:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![11154](https://avatars.discourse-cdn.com/v4/letter/1/d6d6ee/32.png) [@11154](https://discuss.elastic.co/u/11154)\ **Post date:** [June 16, 2014, 11:41am UTC](https://discuss.elastic.co/t/logash-1-4-1-windows-server-2008-tomcat-7-0-30-stuck-with-localhost-access-log-2014-06-16-txt/18131/1 "2014-06-16T11:41:41Z")
Hi! I have stuck with logfile initialization in Windows using Logstash. I want to make logstash read localhost\_access\_log, but seems that Logstash can't understand (or maybe I am somewhere wrong) my path that I try to pass in config-file. input section contains this: file { codec =\> multiline { pattern =\> "^\s" what =\> "previous" } discover\_interval =\> 15 # number (optional), default: 15 path =\> ["c:\apache\logs\foolog.log"] # array (required) start\_position =\> "end" # string, one of ["beginning", "end"] (optional), default: "end" stat\_interval =\> 1 # number (optional), default: 1 tags =\> "foo-mon" # string (optional) type =\> "fooobar" } and contents of c:\apache\logs\foolog.log logfile appear in elastic. But with C:\Apache\logs\localhost\_access\_log.2014-06-16.txt there is a problem - Logstash doesn't want to read this file. Configuration is like this (we also tried to add codec as above): file { discover\_interval =\> 5 # number (optional), default: 15 #exclude =\> ... # array (optional) path =\> ["c:\apache\logs\localhost\_access\_log.\*.txt"] # array (required) start\_position =\> "end" # string, one of ["beginning", "end"] (optional), default: "end" stat\_interval =\> 1 # number (optional), default: 1 tags =\> "foo-mon" # string (optional) type =\> "access" } Please, can someone help? What we also tried: if I rename localhost\_access\_log.2014-06-16.txt to localhost\_access\_log.txt (I also changed name in config), started logstash and changed contents of localhost\_access\_log.txt - it finds file and writes to elastic. Renamed to localhost\_access\_log.2014.txt and used wildcard localhost\_access\_log.\*.txt - not working, so this is not a minus character. ☹ C:\logstash\lib\logstash\version.rb says LOGSTASH\_VERSION = "1.4.1" Someone have any ideas why wildcard is not working? Thanks -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8391119b-b30d-49f2-8133-1b46e4cc721c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8391119b-b30d-49f2-8133-1b46e4cc721c%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![11154](https://avatars.discourse-cdn.com/v4/letter/1/d6d6ee/32.png) [@11154](https://discuss.elastic.co/u/11154)\ **Post date:** [June 16, 2014, 12:10pm UTC](https://discuss.elastic.co/t/logash-1-4-1-windows-server-2008-tomcat-7-0-30-stuck-with-localhost-access-log-2014-06-16-txt/18131/2 "2014-06-16T12:10:45Z")
Have this in logstash log itself: {:timestamp=\>"2014-06-16T15:01:50.817000+0300", :message=\>"\_discover\_file\_glob: c:\apache\logs\localhost\_access\_log2.\*.txt: glob is: []", :level=\>:debug, :file=\>"/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.5.1/lib/filewatch/watch.rb", :line=\>"117"} It looks like logstash can't understand asterisk... -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3ee56a55-304e-425c-9237-e46c37383ea1%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3ee56a55-304e-425c-9237-e46c37383ea1%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![11154](https://avatars.discourse-cdn.com/v4/letter/1/d6d6ee/32.png) [@11154](https://discuss.elastic.co/u/11154)\ **Post date:** [June 16, 2014, 12:37pm UTC](https://discuss.elastic.co/t/logash-1-4-1-windows-server-2008-tomcat-7-0-30-stuck-with-localhost-access-log-2014-06-16-txt/18131/3 "2014-06-16T12:37:38Z")
Done! Damn slashes! It should be as this, then glob search works fine: "/" -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9d2fb117-41ac-4616-9011-600c1d80c02e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9d2fb117-41ac-4616-9011-600c1d80c02e%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:22am UTC](https://discuss.elastic.co/t/logash-1-4-1-windows-server-2008-tomcat-7-0-30-stuck-with-localhost-access-log-2014-06-16-txt/18131/4 "2017-07-06T01:22:08Z")