# Logstash not reading log files from Windows network share folder

**URL:** https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144
**Category:** Logstash
**Created:** [December 17, 2025, 1:02pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144 "2025-12-17T13:02:48Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 17, 2025, 1:02pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/1 "2025-12-17T13:02:48Z")

</div>

Hello,

I am running Logstash 9.1.2 on Windows Server 2019, and i am trying to read logs from a network share folder - //MACHINE-1/folder$/somedir/star\*/some\*star.log ( read the “star” as star character ). But it doesnt read the log files.

I have verified that the user under which Logstash is running has all necessary permissions on the shared folder. Logstash is running as a service as the specific user account.

Thanks in advance.

regards

sabya

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 17, 2025, 1:10pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/2 "2025-12-17T13:10:55Z")

</div>

Hello and welcome,

What does your Logstash input looks like?

Keep in mind that reading files from network shares may not work as expected in Logstash, this is not something that has a lot of tets as mentioned in the [documentation](https://www.elastic.co/docs/reference/logstash/plugins/plugins-inputs-file#_reading_from_remote_network_volumes).

---

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 17, 2025, 1:30pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/3 "2025-12-17T13:30:42Z")

</div>

This is how the input config looks -

input {  
file {  
path =\> "//MACHINE-1/folder$/somedir/_/some_.log"  
start\_position =\> "end"  
file\_completed\_action =\> "log"  
file\_completed\_log\_path =\> "F:/logstash/logs/files\_completed.txt"  
type =\> "type1"  
}  
}

Let me add that i tried with backslash and forwardslash and double escape and so on, in the path pattern.

Another question - how to make Logstash reveal the issue it is having in reading the files? i turned logging level to debug and trace, but did not see anything helpful.

thanks and regards

sabya

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 17, 2025, 7:03pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/4 "2025-12-17T19:03:21Z")

</div>

Oh, this does not work, Logstash does not support Windows Network Share.

There is an [old open issue](https://github.com/logstash-plugins/logstash-input-file/issues/316) about it.

It works with NFS, but they also may have some issues, reading files from network shares is not something that works well with both logstash and beats.

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 18, 2025, 12:06pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/5 "2025-12-18T12:06:45Z")

</div>

I was able to map a network drive, and read a file in LS. Try it.

`SUBST X: \\machine\c$\somedir` or map from Windows.

```auto
input {
	file {
		path => "X:/test.txt"
		start_position => beginning
		sincedb_path => "NUL"
	}
}
...

```

It works, as Leandro said, be aware it might some issues.

---

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 18, 2025, 1:20pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/6 "2025-12-18T13:20:58Z")

</div>

I have a working setup of Logstash 7.9.2 , with input configuration as

`input {`  
`file {`  
`path => [`  
`"//MACHINE-{1,2}/f$/Dir1/Dir2/`_`/name`_`.*.log"`  
`]`  
`type => "ocm-bos"`  
`start_position => "end"`  
`}`  
`}`

And, this one works

---

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 18, 2025, 1:21pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/7 "2025-12-18T13:21:29Z")

</div>

Thanks @Rios !…. i will try it out

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 18, 2025, 1:41pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/8 "2025-12-18T13:41:04Z")

</div>

I have tried, it works.  
You might only have a latency or net. issues, depend on traffic.

---

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 19, 2025, 11:55am UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/9 "2025-12-19T11:55:09Z")

</div>

What version of Logstash are you using ?

---

<div class="post-metadata">

### Author: ![dalal404](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dalal404](https://discuss.elastic.co/u/dalal404)
#### Post date: [December 19, 2025, 12:00pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/10 "2025-12-19T12:00:45Z")

</div>

Are you creating a map or X drive ( X: ) on Windows which maps to \\machine\c$\somedir ?

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 19, 2025, 12:14pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144/11 "2025-12-19T12:14:47Z")

</div>

Yes, with admin share, mapped and LS run under the same account. I'm using 9.2.2, the latest. However should work on the yours also, just pay attachment on the account's privileges.
