I'm running elk stack on my Windows environment. It's work well with
path => "/opt/in/*.log.*"
but It always throws File paths must be absolute, relative path specified when I change to absolute path "C:/Users/vmtri/Desktop/*.log*"
Here is my logstash config:
input { file { path => "C:/Users/vmtri/Desktop/*.log*" start_position => beginning codec => multiline { pattern => "^%{TIME} " negate => true what => previous } } } output { elasticsearch { hosts => "elasticsearch:9200" } file { # we use file output only to debug our grok filter path => "/opt/logstash.out" } }
and here is exception:
$ docker-compose up --abort-on-container-exit Starting 423edae21c43_logstash_for_axon_ivy_elasticsearch_1 ... done Starting logstash_for_axon_ivy_kibana_1 ... done Starting logstash_for_axon_ivy_logstash_1 ... done ... logstash_1 | [2019-12-30T11:56:04,166][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:5000", :ssl_enable=>"false"} logstash_1 | [2019-12-30T11:56:04,526][ERROR][logstash.pipeline ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::File start_position=>\"beginning\", path=>[\"C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log\"], codec=><LogStash::Codecs::Multiline pattern=>\"^%{TIME} \", what=>\"previous\", id=>\"ad365467-2919-450f-9e39-23c3f484f553\", negate=>true, enable_metric=>true, charset=>\"UTF-8\", multiline_tag=>\"multiline\", max_lines=>500, max_bytes=>10485760>, id=>\"d4078cfb698596db61455a4f088a30abddad28f95408c256bbe216cc06b4701c\", enable_metric=>true, stat_interval=>1.0, discover_interval=>15, sincedb_write_interval=>15.0, delimiter=>\"\\n\", close_older=>3600.0, mode=>\"tail\", file_completed_action=>\"delete\", sincedb_clean_after=>1209600.0, file_chunk_size=>32768, file_chunk_count=>140737488355327, file_sort_by=>\"last_modified\", file_sort_direction=>\"asc\">", :error=>"File paths must be absolute, relative path specified: C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log", :thread=>"#<Thread:0x2fd6bca5 run>"} logstash_1 | [2019-12-30T11:56:10,059][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:269:in `block in register'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:267:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:242:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:396:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:200:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:160:in `block in start'"], :thread=>"#<Thread:0x2fd6bca5 run>"} logstash_1 | [2019-12-30T11:56:10,073][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil} logstash_1 | [2019-12-30T11:56:10,291][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600} logstash_for_axon_ivy_logstash_1 exited with code 0 Stopping logstash_for_axon_ivy_kibana_1 ... done Stopping 423edae21c43_logstash_for_axon_ivy_elasticsearch_1 ... done Aborting on container exit...
Could someone please help me check anything wrong.
Thank you