# Logstash not reading remote log files
**URL:** https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919
**Category:** Logstash
**Created:** [July 7, 2016, 8:38am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919 "2016-07-07T08:38:42Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [July 7, 2016, 8:38am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/1 "2016-07-07T08:38:42Z")
Hi,
I have some log files in a remote system, I need to send those to elasticsearch. But logstash is not reading the remote log files. I have specified the following configuration for logstash.
input {
file{
path =\> ["\\web1\C$\msu\logs\prod-hickory\prod-admin-debug.log","\\web1\C$\msu\logs\prod-hickory\prod-admin-error.log"]
start\_position =\> "beginning"
sincedb\_path =\> "demo3\_since.db"
codec =\> multiline {
pattern =\> "^%{TIMESTAMP\_ISO8601} "
negate =\> true
what =\> previous
}
}
}
output{
elasticsearch{
hosts =\> ["xxx.xx.xx.xx:9200"]
}
stdout{
codec =\> rubydebug
}
}
Can you please suggest if anything is wrong in this config file?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 7, 2016, 8:44am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/2 "2016-07-07T08:44:32Z")
You might want to try forward slashes instead of backslashes in the path. If that doesn't help, try increasing the logging verbosity by starting Logstash with `--verbose` or even `--debug` and look for clues.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 7, 2016, 10:44pm UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/3 "2016-07-07T22:44:39Z")
Those look like Windows remote share paths, so `\` is probably valid.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 8, 2016, 5:23am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/4 "2016-07-08T05:23:23Z")
Windows is fine with backslashes (_and_ slashes), but I'm not sure Logstash is. I wouldn't trust its configuration lexer to not mangle them.
---
### Author:  [@renevdm](https://discuss.elastic.co/u/renevdm)
#### Post date: [July 10, 2016, 9:40am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/5 "2016-07-10T09:40:03Z")
> [@Suren92](#):
>
> \web1\C$\msu....
Are you sure there should be a \ between C and $? C$ seems to be more likely as it is the hidden share for the C-drive.
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [July 11, 2016, 8:42am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/6 "2016-07-11T08:42:27Z")
Nothing is working, tried everything, do we have any other possible solution?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 11, 2016, 8:45am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/7 "2016-07-11T08:45:27Z")
Are the input files older than 24 hours? Then you need to adjust the file input's `ignore_older` option.
Also, did you try the suggestion I gave about starting Logstash with `--verbose` or `--debug` to get additional clues?
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [July 11, 2016, 9:28am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/8 "2016-07-11T09:28:41Z")
Does it have anything to do with the authentication of the remote system?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 11, 2016, 9:37am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/9 "2016-07-11T09:37:01Z")
Possibly. If you start Logstash with `--verbose` it'll tell you if it doesn't have permissions to open a file. It'll also tell you if it's not able to find any files (which could also be caused by a lack of permissions) but that _may_ require debug-level logging (i.e. starting with `--debug`), I don't remember OTOH.
---
### Author:  [@Suren92](https://discuss.elastic.co/u/Suren92)
#### Post date: [July 11, 2016, 11:16am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/10 "2016-07-11T11:16:37Z")
No such message was seen in the debug mode or verbose mode.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 11, 2016, 11:18am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/11 "2016-07-11T11:18:54Z")
So it _does_ discover the files? There should be a log entry containing "discover" and the paths to the files you won't to monitor.
Also, what's in your sincedb file? If Logstash already think its current position is at the end of the file it obviously won't do anything.
---
### Author:  [@netaibiswas](https://discuss.elastic.co/u/netaibiswas)
#### Post date: [March 24, 2017, 1:52am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/13 "2017-03-24T01:52:09Z")
I would like to know, how can I set the same path for linux system.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 24, 2017, 6:00am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/14 "2017-03-24T06:00:36Z")
@netaibiswas, please start a new thread for your unrelated question.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/logstash-not-reading-remote-log-files/54919/15 "2017-07-06T04:27:36Z")