Logstash - Reading files from Windows Network Share

Elastic Stack Logstash
1

I'm trying to read log files from a network share on Windows. I know this isn't best practice, but currently there is no way around it, and from the documentation it sounds like it is supported.

However I can not get this working. In the trace log I always get that 0 files are found.

[2022-12-13T10:23:52,832][TRACE][filewatch.discoverer ][main][e67bc34fb15be8fb610b8ac1ec20f025b05bf85e339b9399c18f5e5b87a23c75] discover_files {:count=>0}

I have tried the following in the config file:

input {
	file {
		path => 
		[
			"W:/application1/test.log", #mapped network drive
			"W:\application1\test.log",  #mapped network drive
			"\\server1\logs\application1\test.log",
			"\\server1/logs/application1/test.log",
		]
	}
}

Any ideas, suggestions?

I have noticed there are a couple of topics on this issue, but none of them have an answer:

Thank you

2

I think it simply just doesn't work.. even though the docs say it should work.

At least I couldn't get it to work. I even filed a bug report on github for the file-input plugin, but it hasn't received any attention so far.

3

That's sad to hear, I hope somebody can give some clarity on this issue. What did you end up doing as an alternative?

4

We eventually just decided to use another technology for the specific use case the pipeline was initially set up to handle. We ended up writing a program in C# to replace the logstash pipeline.

1 Like
5

Only this could work: "W:/application1/test.log"
Writing C#? You can make a script to tail&copy log on the local drive.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.