Working with a client that has ELK 6.8.1 Their system produces a JSON file every minute (obviously a lot of files). I've been successful getting them into ES but having an issue with the number open. I'd like it to close the file, but the 'exit_after_read' keeps giving me an error.
Here is my config:
'
input {
file {
path => "/apps/home/reportuser/test/test_json//.json"
start_position => "beginning"
sincedb_path => "/home/reportuser/test/sincedb/test_json.log"
exit_after_read => true
}
}
filter {
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "test_json"
}
}'
When I run Logstash in ' --config.test_and_exit' mode it tells me 'exit_after_read' is invalid but the 6.8.1 docs say otherwise:
[2020-04-03T14:52:18,430][ERROR][logstash.inputs.file ] Unknown setting 'exit_after_read' for file
[2020-04-03T14:52:18,447][FATAL][logstash.runner ] The given configuration is invalid. Reason: Something is wrong with your configuration.
https://www.elastic.co/guide/en/logstash/6.8/plugins-inputs-file.html
Any help appreciated...