Logstash does not start analysing directly

Elastic Stack Logstash
1

Hi,
I have configured Logstash to run on a log file that I have. I have specified the path in the configuration, and I have added some other stuff in the file configuration:

input {
	file {
		path => "C:\users\XXX\Downloads\Logstash\server.log.2017-08-01"
		start_position => "beginning"
		codec => multiline {
			pattern => "^(\d{4}-\d{2}-\d{2}\s*)?\d{2}:\d{2}:\d{2},\d{3}" # Time indicates a new line.
			negate => true
			what => previous
			charset => "ASCII"
		}
	}
}

The problem is that, when I start logstash and the log file is where it's supposed to be, nothing happens. I have to open the file, and like add a space or something (Just make a modification) and then save the file again to make logstash start analysing my logs.
Why does this happen? What I want is to make Logstash start directly without me modifying the file.

Thank you.

2

start_position => "beginning" only matters the first time Logstash sees a file. Even with this setting Logstash won't start from the beginning every time. Read about sincedb in the file input documentation.

3

Thank you.
But removing the line didn't solve the problem.
I launched Logstash, I copied the file into the correct path and Logstash is still on hold.
Same behavior occurs when I start Logstash with the file already in the correct path.

4

I found the solution. There's two options:
1- I have added the sincedb_path into the configuration
2- Launched Logstash with a new log file (Renamed the old one)
3- Before starting Logstash again, I removed the sincedb file that was generated in the path I specified in my previous configuration, and restarted Logstash again. It started analyzing directly.
So I just had to "reset" it's position.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.