Logstash 7 timeout between input file modification and output file write control

Input logstash configuration file was switched to this content:

input {
file{
path => "C:/l/example.txt"
start_position => "beginning"
}
}
output {
file {
path => "C:/l/output.txt"
}
}

Logstash logs contains:

[2019-06-26T12:06:34,417][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-06-26T12:09:23,200][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:09:37,750][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt
[2019-06-26T12:10:04,148][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:10:17,856][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt
[2019-06-26T12:11:18,667][INFO ][logstash.outputs.file ] Opening file {:path=>"C:/l/output.txt"}
[2019-06-26T12:11:38,129][INFO ][logstash.outputs.file ] Closing file C:/l/output.txt

  1. What settings does control timeout between input file edit&save and it's opening by logstash?
  2. How to destroy this timeout properly and parse updated file immediately?
  3. Is there any reason to switch another ELK settings to use this solution with the elasticsearch output plugin and kibana for the same purpose?
  4. After input.txt line addition to the end of file it seems like new line wasn't added to output.txt but previous was (that wasn't presented early). Why so?

Thank you for your assistance. It's great.

Every 10 seconds or so the code closes files that have not been written to in the last 10 seconds. If an event comes along after that that has to be written to the file it is reopened.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.