Logstash 6.5.4 does not output to output file

I have an installed version of logstash.version "=>" 6.5.4 "

I start logstash: sudo initctl start logstash
I want to execute the script recorded in the file 777.conf
input {file {path => "/ home / sonic / log / vs01 / test_new.log" start_position => "beginning" ignore_older => 0 sincedb_path => "/ dev / null"}} output {file {path => " /home/sonic/log/vs01/test_out.log "}}

There are no errors in the logstash-plain.log file with the installed parameter --log.level debug.
When adding entries to test_new.log in the test_out.log file, no changes occur.

If I run logstash:
cd / usr / share / logstash /
bin / logstash -e 'input {file {path => "/ home / sonic / log / vs01 / test_new.log" start_position => "beginning" ignore_older => 0 sincedb_path => "/ dev / null"}} output { file {path => "/ home / sonic / log / vs01 / test_out.log"}} '
Everything works well.

What could be the problem?

assuming this file is what contains your input/output logstash config? where have you put that file in the filesystem in relation to your logstash directory?


From the logstash-plain.log file you can see that the inputs file and the outputs file are defined.

[2019-02-05T10:08:06,916][DEBUG][logstash.inputs.file ] config LogStash::Inputs::File/@path = ["/home/sonic/log/vs01/test_new.log"]
[2019-02-05T10:08:07,017][DEBUG][logstash.outputs.file ] config LogStash::Outputs::File/@path = "/home/sonic/log/vs01/test_out.log"

Sonic user under which I work does not have admin rights on Linux. Maybe a problem with the rights?

This says to ignore files that are more than zero seconds old. Probably not what you want.


I have already tried to remove this parametr does not help. If you run logstash via bin / logstash -e 'input ....., then everything works with "ignore_older => 0".
The difference is that when you run through bin / logstash -e 'input some files are not found
WARNING: Could not find logstash.yml which is typically located in $ LS_HOME / config or / etc / logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN] 2019-02-07 08: 47: 03.377 [LogStash :: Runner] multilocal - Ignoring the 'pipelines.yml'

I tried to remove the logstash.yml and log4j2 configuration files anyway when you start the "sudo initctl start logstash" changes are not displayed in the Outputs file.


Any thoughts on how to solve this problem?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.