Logstash not showing any output (SOLVED)

I manually installed logstash on my mint virtual machine. Used the stdin and stdout version of the config file. No output. Exactly the same result. This has to be some sort of bug in logstash.

cat files/perflog.csv  | logstash -f files/test2.conf -v
Pipeline started {:level=>:info}
Plugin is finished {:plugin=><LogStash::Inputs::Stdin debug=>false, codec=><LogStash::Codecs::Line charset=>"UTF-8">>, :level=>:info}
Logstash startup completed
Plugin is finished {:plugin=><LogStash::Outputs::Stdout codec=><LogStash::Codecs::Line charset=>"UTF-8">, workers=>1>, :level=>:info}
Pipeline shutdown complete. {:level=>:info}
Logstash shutdown completed

Either logstash is majorly messed up or I'm missing something really basic. For completeness I downloaded version 1.4.2. Same result.

EDIT 1:
I cannot reply any longer due to a daily limit. Here is the config:

input {
    stdin {}
}

output {
    stdout {}
}

EDIT 2: Still cannot reply due to daily limit
Problem solved! It turns out my first logfile I am testing with is using old style line endings. This was no problem for my python program processing the CSV file, no problem for sublime or intellij. No problem even for Microsoft Excel running on my Mac. But cat didn't like it, and neither did logstash.

Can we see your entire config?

I know this is a really old post - but like to contribute back. But I had the same issue. I was able to solve it for my part.

Putting in debug mode I was able to get an important message:
_discover_file: /Users/wtaylor/Downloads/logstash-2.2.2/bin/Wayne.csv: skipping because it was last modified more than 86400.0 seconds ago {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"310", :method=>"_discover_file"}
Pushing flush o

When I touched the log file I was reading in boom data started to process

1 Like

does this mean the file was created too long ago?

I'm having similar issues: deal with old files and a lot of them. And so is there any way to change this "86400 second" limitation?

does this mean the file was created too long ago?

No, it means the file was modified too long ago.

I'm having similar issues: deal with old files and a lot of them. And so is there any way to change this "86400 second" limitation?

hi...
when i run logstash config file .it display output but when we run it again then no output displayed.
its new for me.
i installed logstash 2.2,elasticsearch 2.2 and kibana 1.4.
plz reply soon .its urgent.

Please start a new thread.

1 Like

plz explain it .how?

Go here - https://discuss.elastic.co/c/logstash - Click New Thread.

i create it.

Perfect Answer! Saved me a whole lot of time. If it were on stack over flow I would have done a +1.
Thank you

For ignore_older it says By default, this option is disabled, but that doesn't seem to be the case. I had trouble getting logstash to see a file, and touching it fixed it.

For ignore_older it says By default, this option is disabled, but that doesn't seem to be the case.

It was disabled on the master branch about a week ago, but it's definitely still in effect in 2.x. Haven't checked 5.0.

I should have specified, I'm using 5.0.0.

Is there a setting for this that will make it process the file no matter how old it is?

Setting ignore_older to 0 (zero) should disable the feature.

Here logstash is able to create logs but is not creating index in elastic search.
This is my log-config file

input {
tcp {
port => 5022
type => "syslog"
}
udp {
port => 5022
type => "syslog"
}
}

output {
elasticsearch {
hosts => ["192.168.1.103:9200"]
user => "elastic"
password => "changeme"
index => "logstash-%{+YYYY.MM.dd}"
}
stdout { codec => "rubydebug" }
}
Can anyone help me with thid

@honey, please start a new thread for your question instead of trying to resurrect an old one.

1 Like

I meet the same problem, my solution is updating the log document: vim that document, and then wq. haha, logstash print out what i want.

Sorry for the bad Chinglish, lol.