# Logstash don't read lines from imput file SAMBA

**URL:** <https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742>\
**Category:** Logstash\
**Created:** [April 13, 2019, 4:45pm UTC](https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742 "2019-04-13T16:45:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joansa](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@joansa](https://discuss.elastic.co/u/joansa)\
**Post date:** [April 13, 2019, 4:45pm UTC](https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742/1 "2019-04-13T16:45:49Z")

</div>

Hi.

I've a IDS Suricata ina a raspberry-pi, and I install logstash, elasticsearch and kibana in  
my Windows PC.

My idea is show from a SAMBA directory the suricata eve.json log to logstash.  
So, When I run it, logstash dont receive lines.

I probe the seem logstash.conf with a stdin and when i copy a line, logstash get it.

input {  
stdin {  
codec =\> json  
type =\> "SuricataIDPS"  
}  
}

but if I change the input from a file dont get data.  
Note: The S: es the map SAMBA unit in my Windows PC

input {  
file {  
path =\> "S:\eve.json"  
codec =\> json  
type =\> "SuricataIDPS"  
}  
}

I prove charge with a local copy file, but dont get data.

input {  
file {  
path =\> "C:\ELK\eve.json"  
codec =\> json  
type =\> "SuricataIDPS"  
sincedb\_path =\> "NUL"  
start\_position =\> "beginning"  
}  
}

I dont understant. I learning ELK ...  
Perhaps I dont must use the file input with a samba map ...  
Perhaps I need install filebeat in the raspberry-pi...

Could Anyone help me with any idea?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 13, 2019, 5:14pm UTC](https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742/2 "2019-04-13T17:14:05Z")

</div>

> [@joansa](#):
>
> path =\> "S:\eve.json"

Use /, not \, for Windows paths in a file input.

---

<div class="post-metadata">

**Author:** ![joansa](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@joansa](https://discuss.elastic.co/u/joansa)\
**Post date:** [April 15, 2019, 10:47am UTC](https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742/3 "2019-04-15T10:47:43Z")

</div>

Thanks.  
Now, I use / and I have done a test.

I detect that:

The file loads in read mode from the beginning (including from a SAMBA network unit) , but  
if I load in mode TAIL, no load data...

I think if the problem is the end-line char.  
Then I use "delimiter", "\r\n" defaults to "\n" perhaps if Windows logstash not detect the change of line in mode TAIL... but dont work either.

Any idea? I m blocked..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2019, 10:47am UTC](https://discuss.elastic.co/t/logstash-dont-read-lines-from-imput-file-samba/176742/4 "2019-05-13T10:47:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.