I have logstash 7.9 running in centos hosts. I'm facing a strange behavior.
Logstash is not writing to a file in the given path. I want to make sure logstash is working or not so I provided a path in output section but no luck
steps I made logstash to write into file:
- provided /var/log/logstash directory in /etc/logstash/conf.d/messages.conf file
- /var/log/logstash have 775 access and directory under logstash user
- also tried by commenting the sincedb file and sincedb_path sections
questions on this issue:
How do we define the initial 0's in sincedb file im providing '0 0 0 0 0 0' initially but it is not working and I also removed the file to make logstash generate on it's own sincedb file but still not working
here is my config file
input {
file {
path => "/var/solr/logs/solr.log"
}
}
filter {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:TSTAMP}%{SPACE}%{GREEDYDATA:LOG}"]
}
}
output {
if ("_grokparsefailure" in [tags]) {
file {
path => "/opt/logstash/failure-log-data-%{+YYYY-MM-dd}"
}
} else {
file {
path => "/var/log/logstash/logs-messages.log"
}
}
}