Logstash do not allow absolute file path

Elastic Stack Logstash
1

I'm running elk stack on my Windows environment. It's work well with
path => "/opt/in/*.log.*"
but It always throws File paths must be absolute, relative path specified when I change to absolute path "C:/Users/vmtri/Desktop/*.log*"
Here is my logstash config:

input {

    file {

        path => "C:/Users/vmtri/Desktop/*.log*"

        start_position => beginning

        codec => multiline {

            pattern => "^%{TIME} "

            negate => true

            what => previous

        }

    }

}

output {

    elasticsearch {

        hosts => "elasticsearch:9200"

    }

    file {

        # we use file output only  to debug our grok filter

        path => "/opt/logstash.out"

    }

}

and here is exception:

$ docker-compose up --abort-on-container-exit
Starting 423edae21c43_logstash_for_axon_ivy_elasticsearch_1 ... done
Starting logstash_for_axon_ivy_kibana_1                     ... done
Starting logstash_for_axon_ivy_logstash_1                   ... done
...
logstash_1       | [2019-12-30T11:56:04,166][INFO ][logstash.inputs.tcp      ] Starting tcp input listener {:address=>"0.0.0.0:5000", :ssl_enable=>"false"}
logstash_1       | [2019-12-30T11:56:04,526][ERROR][logstash.pipeline        ] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::File start_position=>\"beginning\", path=>[\"C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log\"], codec=><LogStash::Codecs::Multiline pattern=>\"^%{TIME} \", what=>\"previous\", id=>\"ad365467-2919-450f-9e39-23c3f484f553\", negate=>true, enable_metric=>true, charset=>\"UTF-8\", multiline_tag=>\"multiline\", max_lines=>500, max_bytes=>10485760>, id=>\"d4078cfb698596db61455a4f088a30abddad28f95408c256bbe216cc06b4701c\", enable_metric=>true, stat_interval=>1.0, discover_interval=>15, sincedb_write_interval=>15.0, delimiter=>\"\\n\", close_older=>3600.0, mode=>\"tail\", file_completed_action=>\"delete\", sincedb_clean_after=>1209600.0, file_chunk_size=>32768, file_chunk_count=>140737488355327, file_sort_by=>\"last_modified\", file_sort_direction=>\"asc\">", :error=>"File paths must be absolute, relative path specified: C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log", :thread=>"#<Thread:0x2fd6bca5 run>"}
logstash_1       | [2019-12-30T11:56:10,059][ERROR][logstash.pipeline        ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: C:/Users/vmtri/Desktop/ch.ivyteam.ivy.log>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:269:in `block in register'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.8/lib/logstash/inputs/file.rb:267:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:242:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:396:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:200:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:160:in `block in start'"], :thread=>"#<Thread:0x2fd6bca5 run>"}
logstash_1       | [2019-12-30T11:56:10,073][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
logstash_1       | [2019-12-30T11:56:10,291][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
logstash_for_axon_ivy_logstash_1 exited with code 0
Stopping logstash_for_axon_ivy_kibana_1                     ... done
Stopping 423edae21c43_logstash_for_axon_ivy_elasticsearch_1 ... done
Aborting on container exit...

Could someone please help me check anything wrong.
Thank you

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.