# Logstash not reading files input

**URL:** <https://discuss.elastic.co/t/logstash-not-reading-files-input/203908>\
**Category:** Logstash\
**Created:** [October 16, 2019, 6:29pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908 "2019-10-16T18:29:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [October 16, 2019, 6:29pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908/1 "2019-10-16T18:29:44Z")

</div>

Hi

I have configured an elasticsearch cluster with 4 nodes (3 are master/data nodes, and 1 is a coordinating node).

In the coordinating node i have logstash and kibana. But i'm cannot make logstash to read files from input plugin, i have copied the configuration from other server where it works, and as it didnt work in the new server i have simplified it but still not working. In logstash logs there no error message.

logstash configuration is  
1010\_input\_file.conf:

```
input{
  file {
    path => "/opt/audit_logs_modsec/XX/20171231/20171231-2356/*"
    sincedb_path => "/dev/null"
    mode => read
    ignore_older => 0
    start_position => "beginning"
    type => "mod_security"

    codec => multiline {
      charset => "US-ASCII"
      pattern => "^--[a-fA-F0-9]{8}-Z--$"
      negate => true
      what => previous
    }
  }
}

```

3000\_output.conf:

```
output {
  stdout {
        codec => rubydebug
  }
        elasticsearch {
          hosts => ["https://192.168.90.103:9200"]
          cacert => '/etc/logstash/config/certs/ca.crt'
          ssl => true
          user => "elastic"
          password => "XXXX"
          index => "modsecurity_%{+YYYY.MM.dd}"
        }
}

```

Any idea what might be wrong?  
in this configuration i have elk 7.4, in my previous server i had 7.3.

I have used XX to hide certain information, if anyone intereseted i can email de logstash log.

thanks

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [October 16, 2019, 6:51pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908/2 "2019-10-16T18:51:53Z")

</div>

do you have two different config file?  
I thought it should be one config file which has three section  
input {}  
filter {}  
output {}

---

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [October 16, 2019, 7:05pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908/3 "2019-10-16T19:05:25Z")

</div>

you can have several config files, it makes it simple when you have several filters for different conditions.

---

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [October 18, 2019, 8:13pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908/4 "2019-10-18T20:13:21Z")

</div>

the problem was the line

```
ignore_older => 0

```

i removed it and files where procesed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2019, 8:21pm UTC](https://discuss.elastic.co/t/logstash-not-reading-files-input/203908/5 "2019-11-15T20:21:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.