# Logstash not seeing updates in logs by spring boot

**URL:** <https://discuss.elastic.co/t/logstash-not-seeing-updates-in-logs-by-spring-boot/280717>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring, docker\
**Created:** [August 7, 2021, 8:58pm UTC](https://discuss.elastic.co/t/logstash-not-seeing-updates-in-logs-by-spring-boot/280717 "2021-08-07T20:58:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kapil\_Soni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kapil_soni/32/92663_2.png) [@Kapil\_Soni](https://discuss.elastic.co/u/Kapil_Soni)\
**Post date:** [August 7, 2021, 8:58pm UTC](https://discuss.elastic.co/t/logstash-not-seeing-updates-in-logs-by-spring-boot/280717/1 "2021-08-07T20:58:33Z")

</div>

New Logs generated by Spring Boot is not updating in Kibana.  
Logstash =\> ES =\> Kibana  
I'm using spring logback.xml with RollingFileAppender & SizeAndTimeBasedRollingPolicy to generate log file.

Here is my **logstash.conf** file:-

```auto
input {
  file {
        type => "book"
        path => "/usr/share/logs/book-service/book-service.log"
        start_position => "beginning"
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => "previous"
        }
  }
  file {
        type => "user"
        path => "/usr/share/logs/user-service/user-service.log"
        start_position => "beginning"
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => "previous"
        }
  }
  file {
        type => "library"
        path => "/usr/share/logs/library-service/library-service.log"
        start_position => "beginning"
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => "previous"
        }
  }
}
filter {

    if [type] == "book" {
        grok {
          match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:message}" }
        }
    }
    if [type] == "user" {
        grok {
          match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:message}" }
        }
    }
    if [type] == "library" {
        grok {
          match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:message}" }
        }
    }
}
output {
    stdout {
        codec => rubydebug
    }
    if [type] == "book" {
            elasticsearch {
                hosts => ["elasticsearch:9200"]
                index => "jpop-json-book-%{+YYYY.MM.dd}"
                user =>"root"
                password=>"root"
              }
    }
    if [type] == "user" {
            elasticsearch {
                hosts => ["elasticsearch:9200"]
                index => "jpop-json-user-%{+YYYY.MM.dd}"
                user =>"root"
                password=>"root"
              }
    }
    if [type] == "library" {
            elasticsearch {
                hosts => ["elasticsearch:9200"]
                index => "jpop-json-library-%{+YYYY.MM.dd}"
                user =>"root"
                password=>"root"
              }
    }
}

```

I'm running ELK with docker-compose. Below is my docker-compose file for ELK:-

```auto
version: "3"
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.13.4
    container_name: elasticsearch
    environment:
      - node.name=elasticsearch01
      - cluster.name=es-docker-cluster
      - cluster.initial_master_nodes=elasticsearch01
      - bootstrap.memory_lock=true
      - ELASTIC_USERNAME=root
      - ELASTIC_PASSWORD=root
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - ./docker/volumes/elasticsearch/data01:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - elastic

  logstash:
    image: docker.elastic.co/logstash/logstash:7.13.4
    container_name: logstash
    volumes:
      - ./docker/logstash-configs/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./docker/logstash-configs/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - ./JPOP-Loggings:/usr/share/logs
    ports:
      - 9600:9600
    environment:
      - ES_JAVA_OPTS=-Xmx256m -Xmx256m
      - xpack.monitoring.elasticsearch.url=http://elasticsearch:9200
      - xpack.monitoring.elasticsearch.username=root
      - xpack.monitoring.elasticsearch.password=root
      - ELASTIC_USER=root
      - ELASTIC_PASSWORD=root
    depends_on: [elasticsearch]
    networks:
      - elastic
  kibana:
    image: docker.elastic.co/kibana/kibana:7.13.4
    container_name: kibana
    environment:
      - SERVER_NAME=kibana
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=root
      - ELASTICSEARCH_PASSWORD=root
    ports:
      - 5601:5601
    depends_on: [elasticsearch]
    networks:
      - elastic

networks:
  elastic:
    driver: bridge

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2021, 8:58pm UTC](https://discuss.elastic.co/t/logstash-not-seeing-updates-in-logs-by-spring-boot/280717/2 "2021-09-04T20:58:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.