# Logstash in reading files issues

**URL:** <https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275>\
**Category:** Logstash\
**Created:** [June 9, 2016, 5:32am UTC](https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275 "2016-06-09T05:32:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 9, 2016, 5:32am UTC](https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275/1 "2016-06-09T05:32:25Z")

</div>

I have written a logstash conf file to read through logs. It run fine when I specify the log path to a single file. However, if I made it to \*.log, it can't run any files. How can I resolve it?

Here is the one which works.

```
input{
	stdin{}
	file{
		type => "txt"
		path => "C:\HA\accesslog\trial.log"
		start_position => "beginning"
	}
}
filter{
	grok{
	match => {"message" => ["%{IP:ClientAddr}%{SPACE}%{NOTSPACE:access_date}%{SPACE}%{TIME:access_time}%{SPACE}%{NOTSPACE:VirtualHost}%{SPACE}%{WORD:cs-method}%{SPACE}%{PATH:cs-uri-stem}%{SPACE}%{PROG:Protocol}%{SPACE}%{NUMBER:sc-status}%{SPACE}%{NUMBER:bytes}%{SPACE}%{NOTSPACE:RequestedSessionId}%{SPACE}%{PROG:Ecid}%{SPACE}%{NUMBER:ThreadId}%{SPACE}%{NUMBER:EndTs}%{SPACE}%{NUMBER:time-taken}"]}
    	}
	if "_grokparsefailure" in [tags] {
  		drop { }
	}	
}
output{
  	elasticsearch { 
		hosts => ["localhost:9200"] 
		index => "logstash-%{+YYYY.MM.dd}"
		template_overwrite => true
	}
  	stdout { codec => rubydebug }	
}

```

When I change path to

> path =\> "C:\HA\accesslog\*.log"

It could not work.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 10, 2016, 5:43am UTC](https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275/2 "2016-06-10T05:43:33Z")

</div>

Did you try forward slashes instead of backslashes?

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 10, 2016, 6:01am UTC](https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275/3 "2016-06-10T06:01:05Z")

</div>

Oh yea, it solves the issue. But when this would make such a big difference?  
I can still read a single file even with the backslashes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/logstash-in-reading-files-issues/52275/4 "2017-07-06T04:53:44Z")

</div>