# Logstash 7.9 not writing to output file

**URL:** <https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260>\
**Category:** Logstash\
**Created:** [January 5, 2021, 9:51pm UTC](https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260 "2021-01-05T21:51:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![satish92](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@satish92](https://discuss.elastic.co/u/satish92)\
**Post date:** [January 5, 2021, 9:51pm UTC](https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260/1 "2021-01-05T21:51:53Z")

</div>

I have logstash 7.9 running in centos hosts. I'm facing a strange behavior.

Logstash is not writing to a file in the given path. I want to make sure logstash is working or not so I provided a path in output section but no luck

steps I made logstash to write into file:

- provided /var/log/logstash directory in /etc/logstash/conf.d/messages.conf file
- /var/log/logstash have 775 access and directory under logstash user
- also tried by commenting the sincedb file and sincedb\_path sections

questions on this issue:  
How do we define the initial 0's in sincedb file im providing '0 0 0 0 0 0' initially but it is not working and I also removed the file to make logstash generate on it's own sincedb file but still not working

here is my config file

```auto
input {
  file {
    path => "/var/solr/logs/solr.log"
  }
}

filter {
  grok {
    match => ["message", "%{TIMESTAMP_ISO8601:TSTAMP}%{SPACE}%{GREEDYDATA:LOG}"]
  }
}
output {

if ("_grokparsefailure" in [tags]) {
      file {
        path => "/opt/logstash/failure-log-data-%{+YYYY-MM-dd}"
      }
    } else {
  file {
     path => "/var/log/logstash/logs-messages.log"
  }
 }
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 5, 2021, 10:23pm UTC](https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260/2 "2021-01-05T22:23:09Z")

</div>

For debuging purposes try adding

```auto
input {
  file {
    path => "/var/solr/logs/solr.log"
    sincedb_path => "/dev/null"
  }
}

```

and add

The write the output to stdout...

```auto
output {

  stdout { codec => rubydebug }

if ("_grokparsefailure" in [tags]) {
      file {
        path => "/opt/logstash/failure-log-data-%{+YYYY-MM-dd}"
      }
    } else {
  file {
     path => "/var/log/logstash/logs-messages.log"
  }
 }
}

```

Then run manually from the command line... to see what you get...

> **[Running Logstash from the Command Line | Logstash Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/logstash/7.9/running-logstash-command-line.html)**

you will need to specify

`--path.settings` (where the `logstash.yml` is) and `-f` the path to the config file...

---

<div class="post-metadata">

**Author:** ![satish92](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@satish92](https://discuss.elastic.co/u/satish92)\
**Post date:** [January 8, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260/3 "2021-01-08T20:25:43Z")

</div>

Hello Brown,

Thank you for the answer.

I noticed a strange behaviour in logstash 7.9. when I run the config file manually from command line logstash started writing to sincedb file. I started normally many times before running manually but it didn't pick the file. after running config files manually I restarted logstash then it started picking sincedb file not it is working fine.

I didn't check the config earlier manually because when i check in the logstash log file with trace it is validated without any issues.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2021, 8:26pm UTC](https://discuss.elastic.co/t/logstash-7-9-not-writing-to-output-file/260260/4 "2021-02-05T20:26:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.