Logstash missing files

Elastic Stack Logstash
1

Hi

See my logstash input config -

#input {
file {
path => "/data/logs/*"
mode => "read"
file_completed_action => "log"
file_completed_log_path => "/data/logstash-db/17_file_completed_log"
}
}

I placed 4389 files in /data/logs/

When doing cat /data/logstash-db/17_file_completed.log | wc -l

it is saying 3211, so it is missing/ignoring 1178 of the files.

How do i determine why it is decided to completely ignore these files?

I also get different results each time, if i delete the index/clear the sincedb ect and re-copy them, sometimes it will do all of them, sometimes less.

2

All I can suggest is to enable '--log.level trace' and wade through tens of thousands of lines of filewatch trace messages to see what is different about the files that it does not read.

3

Hey @Badger

How do i go about doing this?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.