Logstash doesn't remove proceed gz files

Elastic Stack Logstash
1

I've setup logstash as file reader for *.gz log files in "read" mode.
These files are copied from remote server to local folders every 15 minutes under user logstash.

Files and folders have owner "logstash" and mode - 0644.

What i observer, that logstash is reading files, write them to since_db but not removing.
Also there are subfolders with month and date in parent folder.

Example: /opt/logstash/remote_logs/12/22/log.gz

   file {
        path => ["/opt/logstash/remote_logs/**/*.gz"]
        sincedb_path => "/etc/logstash/conf.d/filereader/since_remote.db"
        mode => "read"
   }

Also i didn't get any errors in logstash-plain.log regarding logstash cannot remove file.

Logstash version is: 7.10.0

Please advise how to solve this problem.

Thank you.

2

What do you mean by remove here, are you expecting Logstash to delete them?

3

Yes, i want to delete files after they will be proceed by logstash.

4

You need to set https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-file_completed_action

5

Can you enable log.level debug and see if it goes through the deletable file handling?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.