Logstash Log - [ERROR][logstash.inputs.file ] each: ignored?

Elastic Stack Logstash
1

Hi!
I am running Logstash in Windows and, in my input I have the following lines:

file {
    path => "E:/logs/firewall/*/*firewall.txt"
    start_position => "beginning"
    sincedb_path => "E:/logs/firewall/firewall_sincedb_path"
    ignore_older => 90000
}

I am getting these errors in the logstash log:

[2018-03-19T00:00:54,941][ERROR][logstash.inputs.file ] each: ignored?: E:/logs/firewall/2017-09-20/2017-09-firewall.txt: (#<Errno::ESRCH: No such process - E:/logs/firewall/2017-09-20/2017-09-20_firewall.txt>)

It looks like Logstash is reading from folders last modified in September which is creating a huge backlog of these error lines.
Does anyone know what is the problem here? Why is Logstash creating these errors?
Thanks!

2

Hi,

I'm facing a similar issue with Logstash. I have exactly the same type of errors than you do.
I was doing some tests using the debug mode and I can always reproduce this. These are the steps:

  1. Start Logstash with a ignore_older config value that will make some of folder/files from the path to be ignored
  2. After some time delete one of those folders/files. One log entry of this type will be written everytime the stat_interval config value is reached.

If I do not use the ignore_older configuration, Logstash will manage the files correctly.

Any clues about how to avoid this situation?

Thank you.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.