Logstash How to read only name of the file

Elastic Stack Logstash
1

Hi I'am new to elasticsearch.
I wanted to know if there was a possible way to read only the names of the files and ignore the contents inside (I must ignore it to prevent error. I saw this posts but it didn't work for me me:

Thanks in advance

2

It could be done using filebeat to read the files and then in logstash

mutate { remove_field => [ "message" ] }
if [offset] != 0 { drop {} }

but reading all the files and discarding the contents is ridiculously wasteful. Why not feed the output from ls -l to logstash?

3

Hi @Badger, thanks for your reply.
I tried :

mutate { remove_field => [ "message" ] }
if [offset] != 0 { drop {} }

But it don't send any date to elasticsearch :slightly_frowning_face:.
This one could be a good solution:

Why not feed the output from ls -l to logstash?

But I don't know how :sweat_smile:. I am using the file input (I need him to go through my folder), can i keep the file input and feed the input with ls -l?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.