# Logstash file-input problem

**URL:** https://discuss.elastic.co/t/logstash-file-input-problem/142395
**Category:** Logstash
**Created:** [July 31, 2018, 3:07pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395 "2018-07-31T15:07:02Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![sivap](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sivap](https://discuss.elastic.co/u/sivap)
#### Post date: [July 31, 2018, 3:07pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/1 "2018-07-31T15:07:03Z")

</div>

Hi Team,

Every 5 minutes once my cron job will create one new text file ( filename with time - jobs\_00:00.txt, jobs\_00:05.txt, jobs\_00:10.txt, jobs\_00:15.txt, and so on..). So I have created logstash config using file-input to read the content from those file in the specified location (/mnt/arlo\_input/\*).

But here some point of time logstash is not reading the log files. Any ideas what could be the problem?

Please find the logstash config as below,  
input {  
file {  
path =\> "/mnt/arlo\_input/\*"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
ignore\_older =\> 0  
discover\_interval =\> 2  
}  
}

Please, could someone help me!

Thanks  
Siva.P

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 31, 2018, 3:13pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/2 "2018-07-31T15:13:12Z")

</div>

> [@sivap](#):
>
> path =\> "/mnt/arlo\_input/\*"

Is that a network mount? If so, did you read the caveat in the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#_reading_from_remote_network_volumes)?

> [@sivap](#):
>
> ignore\_older =\> 0

You are telling it to ignore any file that was modified more than zero seconds ago. Which is pretty much every file, right? What are you trying to achieve using this option?

---

<div class="post-metadata">

### Author: ![Charaf\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charaf_ahmed/32/30467_2.png) [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [July 31, 2018, 3:14pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/3 "2018-07-31T15:14:07Z")

</div>

Simple :

```
input{
        path => "/mnt/arlo_input/*.txt"
   }
```

---

<div class="post-metadata">

### Author: ![sivap](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sivap](https://discuss.elastic.co/u/sivap)
#### Post date: [August 2, 2018, 1:10pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/4 "2018-08-02T13:10:14Z")

</div>

@Badger & @Charaf_Ahmed Thanks for the response!

I have removed the ignore\_older parameter and tried \*.txt. But still, logstash missing some files to read.

Could you please suggest some solution.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 2, 2018, 1:42pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/5 "2018-08-02T13:42:26Z")

</div>

Enable debug logging. Pay close attention to the \_globbed\_files and \_discover\_file lines in the resulting output.

---

<div class="post-metadata">

### Author: ![Charaf\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charaf_ahmed/32/30467_2.png) [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [August 2, 2018, 2:09pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/6 "2018-08-02T14:09:58Z")

</div>

Remove everything and just leave the path to make sure everything is OK. Then make another change

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2018, 2:09pm UTC](https://discuss.elastic.co/t/logstash-file-input-problem/142395/7 "2018-08-30T14:09:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
