# Logstash not able to read input file

**URL:** <https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018>\
**Category:** Logstash\
**Created:** [July 31, 2019, 2:22am UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018 "2019-07-31T02:22:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sachin\_Nerurkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sachin_nerurkar/32/51293_2.png) [@Sachin\_Nerurkar](https://discuss.elastic.co/u/Sachin_Nerurkar)\
**Post date:** [July 31, 2019, 2:22am UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/1 "2019-07-31T02:22:40Z")

</div>

I have following code.  
input {  
file {  
path =\> "C:\logstash-7.2.0\samples\test\_10.log"  
start\_position =\> "beginning"  
ignore\_older =\> 0  
}  
}

filter {

}

output {  
stdout { codec =\> rubydebug}  
}

I ran in debug mode after deleting sincedb file from default location.  
I am constantly getting following message in the log files:  
[2019-07-30T21:59:19,509][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu  
[2019-07-30T21:59:19,722][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2019-07-30T21:59:19,723][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}  
[2019-07-30T21:59:21,970][DEBUG][org.logstash.execution.PeriodicFlush] Pushing flush onto pipeline.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [July 31, 2019, 9:18am UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/2 "2019-07-31T09:18:12Z")

</div>

Run in TRACE mode. The file input will log more info on what decisions it is making when it "discovers" the file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2019, 12:25pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/3 "2019-07-31T12:25:55Z")

</div>

Do not use backslash in the path option of a file input, use forward slash.

---

<div class="post-metadata">

**Author:** ![Sachin\_Nerurkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sachin_nerurkar/32/51293_2.png) [@Sachin\_Nerurkar](https://discuss.elastic.co/u/Sachin_Nerurkar)\
**Post date:** [July 31, 2019, 2:08pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/4 "2019-07-31T14:08:06Z")

</div>

THanks both of you. I implemented both the suggestions and getting follows:

[2019-07-31T09:46:54,623][TRACE][filewatch.sincedbcollection] associate: finding {"inode"=\>"3054569709-95108-11403264", "path"=\>"C:/logstash-7.2.0/samples/test\_10.log"}  
[2019-07-31T09:46:54,629][TRACE][filewatch.sincedbcollection] associate: unmatched  
[2019-07-31T09:46:54,647][TRACE][filewatch.discoverer] Discoverer discover\_files: C:/logstash-7.2.0/samples/test\_10.log: skipping because it was last modified more than 0.0 seconds ago

Not able to understand the disconnect. I am deleteing the sincedb file before every run.

---

<div class="post-metadata">

**Author:** ![Sachin\_Nerurkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sachin_nerurkar/32/51293_2.png) [@Sachin\_Nerurkar](https://discuss.elastic.co/u/Sachin_Nerurkar)\
**Post date:** [July 31, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/5 "2019-07-31T14:19:50Z")

</div>

I commented out ignore\_older =\> 0 and got it working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-read-input-file/193018/6 "2019-08-28T14:19:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.