Input logstash configuration file was switched to this content:
input {
file{
path => "C:/l/example.txt"
start_position => "beginning"
}
}
output {
file {
path => "C:/l/output.txt"
}
}
Logstash logs contains:
[2019-06-26T12:06:34,417][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-06-26T12:09:23,200][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:09:37,750][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt
[2019-06-26T12:10:04,148][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:10:17,856][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt
[2019-06-26T12:11:18,667][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:11:38,129][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt
- What settings does control timeout between input file edit&save and it's opening by logstash?
- How to destroy this timeout properly and parse updated file immediately?
- Is there any reason to switch another ELK settings to use this solution with the elasticsearch output plugin and kibana for the same purpose?
- After input.txt line addition to the end of file it seems like new line wasn't added to output.txt but previous was (that wasn't presented early). Why so?
Thank you for your assistance. It's great.