Logstash file input not working 6.4.0

Elastic Stack Logstash
1

Hi, I have been trying to use the logstash file input but it is not reading the file, the sincedb file is empty, I have tried all options available, mentioned in all similar threads. Setting sincedb_path to null, tried changing mode from tail to read, the start_position = beginning, none seem to working.

input {
  file {
    path => "/home/vagrant/sample.log"
    start_position => "beginning"
   # sincedb_path => "/dev/null"
    ignore_older => 0
  }
}

output {
  stdout { codec => rubydebug }
  elasticsearch {
    hosts    => [ "192.168.10.20"]
    user     => "elastic"
    index    => "test-logs-%{+yyyy.MM.dd}"
  }
}

I only see this in the logstash-plain.log

[2018-10-12T09:55:06,168][INFO ][filewatch.observingtail ] START, creating Discoverer, Watch with file and sincedb collections

2

even when setting my own sincedb path , the file remains empty.

Also when enabled debug logging I see, these lines being repeated continously

2018-10-12T12:12:19,910][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"sample-shipper-pipeline", :thread=>"#<Thread:0x6e3a666 sleep>"}

3

Try changing sincedb_path to /tmp/sincedb_file and check if logstash has been able to write on this file. It may be due to logstash don't have permission to read the file /home/vagrant/sample.log

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.