Logstash Not Creating Muy Index

Elastic Stack Logstash
1

I am attempting to index my IIS logs using logstash. I found an example config file From THIS web site. I used it as is as my Logstash configuration and it ran with no error. I then began seeing this in the command window
11:43:44:161 [Ruby-0-Thread-12: D:/logstash-production/logstash-core/lib/logstash/pipeline.rb:538] DEBUG logstash.pipeline - - Pushing flush onto pipeline. After several of these lines repeating I then get this.

11:43::44:378 [{main]<file] DEBUG logstash.inputs.file - _globbed_files: \servername\C$\inetpub\logs\logfile**.log: glob is :[ ]

This pattern continued for about 15 minutes during this time I was checking Kibana for the Index to appear and it was never created. I checked the security logs on my IIS server and I can see the account logstash was running under logging on and off the server, so I know it is contacting the server.

Can anyone explain why I am not getting any data?

2

The log message you found indicates that the filename pattern isn't matching any files. Does Logstash have access to \\servername\c$? Does it work if you use forward slashes instead of backslashes?

3

Thank you for your response after, changing to forward slashes it worked.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.