Hi!
I'm started a new pipeline for reading xml from a cifs mounted unit from a Windows Server in my centos server, the issue I have is that logstash reads the unit each 3 hours and I don't know why, I'm indexing old files, and when i started logstash 3 hours later start to read about 25K files and then stop discovering files for 3 hours, and then start to read about 25K files and then stop again discovering, I couldn't find anything relevant and logstash log.
My config file:
input {
file {
mode => "read"
start_position => "beginning"
#close_older => "0"
#ignore_older =>"0"
path => "/logs/xxxx/**/*.xml"
sincedb_path => "/home/xxxx/xxxxx"
file_completed_action => "log"
file_completed_log_path => "/home/xxx/xxxx.txt"
codec =>
multiline {
pattern => "<xxxx>"
negate => true
what => "previous"
} }
file {
mode => "read"
start_position => "beginning"
path => "/logs/xxx/**/*.xml"
#close_older => "0"
#ignore_older =>"0"
sincedb_path => "/home/xxx/xxxx"
file_completed_action => "log"
file_completed_log_path => "/home/xxxx/xxxx.txt"
codec =>
multiline {
pattern => "<xxxxx>"
negate => true
what => "previous"
}}}
Could anyone help me with this?
BE