Logstash read all CSV

Elastic Stack Logstash
1

this one kind of confuses me.

I have 4 logfiles, all CSV format.

logfile13.csv
logfile14.csv
logfile15.csv
logfile16.csv

myconfig states:

   path => "/var/log/csv/logfile*"
  start_position => "beginning"
  sincedb_path => "logstash.sincedb"

i started with empty sincedb file. My thought is logstash will read all CSV files and send them to elasticsearch. I went to discover page and found that only logfile13.csv was loaded.

the sincedb file has the following:
4907010 0 64778 169780936 1570565952.73288 /var/log/csv/logfile13.csv
4907013 0 64778 91910063 1570565952.593822 /var/log/csv/logfile14.csv
4907011 0 64778 157496500 1570565952.743978 /var/log/csv/logfile15.csv
4907012 0 64778 147746309 1570565952.59943 /var/log/csv/logfile16.csv

Any thoughts/tips are greatly appreciated.

2

found it! leading space character!

"datetime" => " 2019-10-01 08:37:57.467"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.