Logstash 6.8 Input File not using exit_after_read

Working with a client that has ELK 6.8.1 Their system produces a JSON file every minute (obviously a lot of files). I've been successful getting them into ES but having an issue with the number open. I'd like it to close the file, but the 'exit_after_read' keeps giving me an error.

Here is my config:
'
input {
file {
path => "/apps/home/reportuser/test/test_json//.json"
start_position => "beginning"
sincedb_path => "/home/reportuser/test/sincedb/test_json.log"
exit_after_read => true
}
}

filter {

}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "test_json"
}
}'

When I run Logstash in ' --config.test_and_exit' mode it tells me 'exit_after_read' is invalid but the 6.8.1 docs say otherwise:

[2020-04-03T14:52:18,430][ERROR][logstash.inputs.file ] Unknown setting 'exit_after_read' for file
[2020-04-03T14:52:18,447][FATAL][logstash.runner ] The given configuration is invalid. Reason: Something is wrong with your configuration.

https://www.elastic.co/guide/en/logstash/6.8/plugins-inputs-file.html

Any help appreciated...

Support for exit_after_read was merged into the 'master' branch 6 weeks ago. I don't see any indication there was a backport into older versions. If it only went into master I am not sure it will be in any currently available release.

Well rats. So they would have to update to the current version to get that functionality is what I am hearing? I guess the documentation is incorrect (no blame here).

Can you think of another way to handle this?

Does reducing close_after help?

I think you mean 'close_older'? I'm going to look at it now

that worked! Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.