Logstash read file in what order?

[theirfan]

Logstash/grok to match only first occurrence and stop parsing repeatedly for same values

What I would do is grok { pattern_definitions => { "CUSTOMTIME" => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME}" } match => { "message" => "%{CUSTOMTIME:[@metadata][timestamp]} %{GREEDYDATA:[@metadata][restOfLine]}" } } date { match => [ "[@metadata][timestamp]", "EEE MMM dd HH:mm:ss" ] } ruby { init => '@lastValue = nil' code => ' now = event.get("@timestamp").to_f if @lastValue == nil @lastTime = now e…

based on your earlier solution for getting time durations of each value, can we add another parameter to also check the change of path or filename too?

Like, this code of yours is checking of change of value and subtracting timestamps to get durations. If this code can also check change of path, and parse new file as separate file.

Let me know about it?