Hi
I have added the field "file_completed_action=> "delete" but logstash don't delete files.
This is my logstash.conf and docker-compose
input {
file {
path => "/usr/share/logstash/inputlogs/*.csv"
start_position => "beginning"
mode => "read"
sincedb_path => "/usr/share/logstash/.sincedb"
file_completed_action => "delete"
}
}filter {
csv {
separator => ";"
columns => ["Protocol_Version","Site_Producer_Name","Site_Producer_ID","Site_Sender_
skip_header => true
}
mutate{
remove_field => ["Protocol_Version","Site_Producer_Name","Site_Producer_ID",
}
date{
match => ["Event_Timestamp", "dd/MM/yyyy HH:mm:ss"]
}
mutate{
remove_field => ["Event_Timestamp", "message", "host"]
}
}output {
elasticsearch {
hosts => "elasticsearch:9200"
index => "lab-benchmarking-csv"
}
stdout{}
}
This is my docker-compose
version: '3.5'
services:
elasticsearch:
build:
context: elasticsearch/
container_name: elasticsearch
volumes:
- ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
- ./elasticsearch/data:/data
ports:
- "9200:9200"
- "9300:9300"
environment:
ES_JAVA_OPTS: "-Xmx256m -Xms256m"
networks:
- elklogstash:
build:
context: logstash/
container_name: logstash
user: root
volumes:
- ./logstash/config:/usr/share/logstash/config
- ./logstash/pipeline:/usr/share/logstash/pipeline
- logfiles:/usr/share/logstash/inputlogs
ports:
- "5000:5000"
environment:
LS_JAVA_OPTS: "-Xmx256m -Xms256m"
networks:
- elk
depends_on:
- elasticsearchkibana:
build:
context: kibana/
container_name: kibana
volumes:
- ./kibana/config/:/usr/share/kibana/config:ro
ports:
- "5601:5601"
networks:
- elk
depends_on:
- elasticsearch
Thanks for advanced.