Logstash not able to read input file

Elastic Stack Logstash
1

I have following code.
input {
file {
path => "C:\logstash-7.2.0\samples\test_10.log"
start_position => "beginning"
ignore_older => 0
}
}

filter {

}

output {
stdout { codec => rubydebug}
}

I ran in debug mode after deleting sincedb file from default location.
I am constantly getting following message in the log files:
[2019-07-30T21:59:19,509][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2019-07-30T21:59:19,722][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2019-07-30T21:59:19,723][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2019-07-30T21:59:21,970][DEBUG][org.logstash.execution.PeriodicFlush] Pushing flush onto pipeline.

2

Run in TRACE mode. The file input will log more info on what decisions it is making when it "discovers" the file.

3

Do not use backslash in the path option of a file input, use forward slash.

4

THanks both of you. I implemented both the suggestions and getting follows:

[2019-07-31T09:46:54,623][TRACE][filewatch.sincedbcollection] associate: finding {"inode"=>"3054569709-95108-11403264", "path"=>"C:/logstash-7.2.0/samples/test_10.log"}
[2019-07-31T09:46:54,629][TRACE][filewatch.sincedbcollection] associate: unmatched
[2019-07-31T09:46:54,647][TRACE][filewatch.discoverer ] Discoverer discover_files: C:/logstash-7.2.0/samples/test_10.log: skipping because it was last modified more than 0.0 seconds ago

Not able to understand the disconnect. I am deleteing the sincedb file before every run.

5

I commented out ignore_older => 0 and got it working.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.