Logstash file wont run

Elastic Stack Logstash
1

I have the following logstash configuration file. When i try to run it..it won't show up on stdout...what it wrong with it? It worked before...what happened now? PLEASE HELP!

input {
file {
path => [ "/opt/cast/report.log" ]
type => "dn_reportlog"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {
grok {
match => ["message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}
"]
tag_on_failure => ["_grokparsefailure_match1"]
}

grok {
match => ["message", "%{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}"]
tag_on_failure => ["_grokparsefailure_match2"]
}

mutate {
    remove => [ "message" ]
}

}

output {
stdout { codec => rubydebug }
redis { host => "10.10.32.141" data_type => "list" key => "num1" }
}

2

Please someone help! I am stuck on this for a very long time and I cannot figure out why :frowning:

3

Can someone please point me in the right direction?
I tried to run other logstash sample files..and they seem to work fine but this config file wont work!

4

when I use the --debug option when starting logstash I get the following:

_globbed_files: /opt/Oracle/Middleware/weblogic12c/user_projects/domains/ph2stg1/logs/dn_report.log: glob is: ["/opt/cast/report.log"] {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"346", :method=>"_globbed_files"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}
_globbed_files: /opt/Oracle/Middleware/weblogic12c/user_projects/domains/ph2stg1/logs/dn_report.log: glob is: ["/opt/cast/report.log"] {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"346", :method=>"_globbed_files"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}
Pushing flush onto pipeline {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"}

What does it mean?

5

I fixed this issue.
I added the line ignore_older = 0

6

If the input file is older than 24 hours you need to adjust the file input's ignore_older option.