Logstash Log - [ERROR][logstash.inputs.file ] each: ignored?

I am running Logstash in Windows and, in my input I have the following lines:

file {
    path => "E:/logs/firewall/*/*firewall.txt"
    start_position => "beginning"
    sincedb_path => "E:/logs/firewall/firewall_sincedb_path"
    ignore_older => 90000

I am getting these errors in the logstash log:

[2018-03-19T00:00:54,941][ERROR][logstash.inputs.file ] each: ignored?: E:/logs/firewall/2017-09-20/2017-09-firewall.txt: (#<Errno::ESRCH: No such process - E:/logs/firewall/2017-09-20/2017-09-20_firewall.txt>)

It looks like Logstash is reading from folders last modified in September which is creating a huge backlog of these error lines.
Does anyone know what is the problem here? Why is Logstash creating these errors?


I'm facing a similar issue with Logstash. I have exactly the same type of errors than you do.
I was doing some tests using the debug mode and I can always reproduce this. These are the steps:

  1. Start Logstash with a ignore_older config value that will make some of folder/files from the path to be ignored
  2. After some time delete one of those folders/files. One log entry of this type will be written everytime the stat_interval config value is reached.

If I do not use the ignore_older configuration, Logstash will manage the files correctly.

Any clues about how to avoid this situation?

Thank you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.