# Logstash on many files

**URL:** <https://discuss.elastic.co/t/logstash-on-many-files/126458>\
**Category:** Logstash\
**Created:** [April 2, 2018, 7:15pm UTC](https://discuss.elastic.co/t/logstash-on-many-files/126458 "2018-04-02T19:15:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pcouas](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pcouas](https://discuss.elastic.co/u/pcouas)\
**Post date:** [April 2, 2018, 7:15pm UTC](https://discuss.elastic.co/t/logstash-on-many-files/126458/1 "2018-04-02T19:15:21Z")

</div>

Hi,

My Kibana5.6.8 logstash configuration seems only reading one log file ?  
then logdate field is viewing as string and not as date ?  
My logstash.conf on /home/elastichsearch/confLogs is

input {  
file {  
type =\> "static"  
path =\> "/home/elasticsearch/static\_logs/\*\*/_Web.log_" exclude =\> "\*.zip"  
start\_position =\> beginning  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
if [type] == "static" {  
if [message] !~ /(.+)/ {  
drop { }  
}

filter {  
if [type] == "static" {  
if [message] !~ /(.+)/ {  
drop { }  
}  
grok{  
patterns\_dir =\> "./patterns"  
overwrite =\> ["message"]  
# 2017-08-07 11:47:35,466 INFO [http-bio-10.60.2.19-10267-exec-60] jsch.DeployManagerFileUSImpl (DeployManagerFileUSImpl.java:155) - Deconnexion de l'hote qvirmqa3  
# 2017-08-07 11:47:51,775 ERROR [http-bio-10.60.2.19-10267-exec-54] service.BindingsRSImpl (BindingsRSImpl.java:143) - Can't find bindings file deployed on server  
# 2017-08-03 16:01:11,352 WARN [Thread-552] pcf2.AbstractObjetMQDAO (AbstractObjetMQDAO.java:137) - Descripteur de  
match =\> ["message", "%{TIMESTAMP\_ISO8601:logdate},%{INT} %{LOGLEVEL:logLevel} [(?[^]]+)] %{JAVACLASS:package} (%{JAVAFILE:className}:%{INT:line}) - %{GREEDYDATA:message}" ]  
}  
# 2017-08-03 16:01:11,352  
date{  
match =\> ["logdate", "YYYY-MM-dd hh:mm:ss"]  
target =\> "logdate"  
}  
}  
}  
output {  
elasticsearch { hosts =\> ["192.168.99.100:9200"]}

My logs directory, with load balanced logrotate files

static\_logs  
--prd1  
----mlog Web.log  
----mlog Web.log.1  
----mlog Web.log.2  
--prd2  
----mlog Web.log  
----mlog Web.log.2

When i replace all theses files with one logfile and  
path =\> "/home/elasticsearch/static\_logs/_Web.log" exclude =\> "_.zip"

That's Ok kibana 5.6.8 see logdate as date field and not as string field !!  
It seems me my logs files are not correctly order by writting date ?

Why ?  
Regards

---

<div class="post-metadata">

**Author:** ![pcouas](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pcouas](https://discuss.elastic.co/u/pcouas)\
**Post date:** [April 8, 2018, 8:18am UTC](https://discuss.elastic.co/t/logstash-on-many-files/126458/2 "2018-04-08T08:18:36Z")

</div>

Hi

If all my imput files are more 140M, kibana not seeing logdate field as an date field, but as an string field !!

Why ? How increase limit ?  
Regards  
I use logstash/kibana 5.6.8 and each separate log file are 20M

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2018, 8:18am UTC](https://discuss.elastic.co/t/logstash-on-many-files/126458/3 "2018-05-06T08:18:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.