# Logstash Parsing File (Without Filebeat)

**URL:** https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160
**Category:** Logstash
**Created:** [January 23, 2020, 1:25am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160 "2020-01-23T01:25:18Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![ellje](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 23, 2020, 1:25am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/1 "2020-01-23T01:25:18Z")

</div>

Trying to simply have logstash parse a file. I've checked that the file input path is correct, and when I tail the logtash log file, there is no update/activity. Is there anything else that I can check to ensure that it's parsing as it should be?

---

<div class="post-metadata">

### Author: ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [January 23, 2020, 2:01pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/2 "2020-01-23T14:01:38Z")

</div>

Could you write your input configuration?  
It will make troubleshooting easier.

---

<div class="post-metadata">

### Author: ![ellje](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 23, 2020, 5:57pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/3 "2020-01-23T17:57:31Z")

</div>

```auto
file {
        path => ["<pathToFile>/*.log"]
        type => "example_type"
        start_position => beginning
        close_older => 180
        codec => multiline {
            auto_flush_interval => 1
            patterns_dir => ["/etc/logstash/conf.d/patterns"]
            negate => "true"
            pattern => "^ERROR:\s+"
            what => "previous"
            max_lines => 2
        }
    }

```

You mean this input configuration? It should be similar to the other configurations, which are working correctly. This one on the other hand is the only one that doesn't register for some reason. I've triple checked the path to ensure that it's the correct directory, too

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 23, 2020, 6:07pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/4 "2020-01-23T18:07:31Z")

</div>

Set the log.level to TRACE and see what filewatch has to say.

---

<div class="post-metadata">

### Author: ![ellje](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 23, 2020, 6:45pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/5 "2020-01-23T18:45:00Z")

</div>

How do I access filewatch? Is that a separate tool within Elasticsearch?

I did get it to TRACE, now I see this line:

```auto
[2020-01-23T19:21:15,496][DEBUG][logstash.inputs.file] _globbed_files: <pathToFile>/*.log: glob is: ["<pathToFile>/log_name.log"]

```

So at least the glob is not empty, but it still does not parse it

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 23, 2020, 9:11pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/6 "2020-01-23T21:11:29Z")

</div>

You should be seeing lines like [these](https://discuss.elastic.co/t/logstash-wildcards-regex-not-working/164204/2). filewatch is the library that the file input uses to read files.

---

<div class="post-metadata">

### Author: ![ellje](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 23, 2020, 11:35pm UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/7 "2020-01-23T23:35:28Z")

</div>

@Badger what should I do if I do not see any line with filewatch? Is it something that I need to set up then, or should it already be included?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 24, 2020, 12:19am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/8 "2020-01-24T00:19:17Z")

</div>

If you have log.level set to TRACE (not DEBUG) then if the path option glob matches any files I cannot conceive of filewatch not logging anything.

---

<div class="post-metadata">

### Author: ![ellje](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 24, 2020, 12:34am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/9 "2020-01-24T00:34:22Z")

</div>

I do have it on trace, though (not debug)

```auto
log.level: trace
path.logs: /var/log/logstash

```

Maybe I'm tailing the wrong file? I'm tailing /var/log/logstash/logstash-plain.log

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2020, 12:34am UTC](https://discuss.elastic.co/t/logstash-parsing-file-without-filebeat/216160/10 "2020-02-21T00:34:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.