Logstash Not parsing the file when running the again on the same file


(Akul Kapoor) #1

I ran logstash successfully using my log and config file. After that I stopped it and ran again using the same config file and log file, the logstash does not give any output.
Can someone explain why logstash is not running the second after running perfectly for the first time.
Note: I am struck because i do not get any error. Following is what i get, when I run logstash the second time:

[2017-01-07T15:01:32,029][INFO ][logstash.filters.geoip ] Using geoip database {:path=>"/elk/logstash-5.1.1/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/vendor/GeoLite2-City.mmdb"}
[2017-01-07T15:01:32,076][INFO ][logstash.filters.geoip ] Using geoip database {:path=>"/elk/logstash-5.1.1/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/vendor/GeoLite2-City.mmdb"}
[2017-01-07T15:01:32,091][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-01-07T15:01:32,099][INFO ][logstash.pipeline ] Pipeline main started
[2017-01-07T15:01:32,316][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}


(Ed) #2

yes logstash remembers where it left off .

I your testing set the file parameter for sincedb_path to /dev/null so it does not save the position. Then when you have what you like then remove this parameter


(Akul Kapoor) #3

thank you so much. that solved my problem. :slight_smile:


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.