# Logstash Runs And Does Nothing

**URL:** <https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932>\
**Category:** Logstash\
**Created:** [April 12, 2021, 6:21pm UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932 "2021-04-12T18:21:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![baklavadeseni](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\
**Post date:** [April 12, 2021, 6:21pm UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932/1 "2021-04-12T18:21:12Z")

</div>

Hi there,

I have simple file input/output logstash pipeline. Logstash runs but does nothing. There is no output. In logstash log file only suspicious thing is this "One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu". Just in case i check my input folder there is several log file there. I cleared data folder as well. But nothing happens.

I'm using windows 10, logstash 7.12.0

Here is my .conf file

```auto
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input{
	file{
		path => "D:/Logs/*.log"
		start_position => "beginning"
		ignore_older => 0
	}
}

filter {
  grok{
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} \[%{DATA:gereksiz}\] %{LOGLEVEL:log-level} %{DATA:gereksiz2} \[%{DATA:gereksi3}\] %{DATA:gereksiz4}%{DATA:gereksiz5}- (?<TranDate>([TranDate]*=[a-zA-Z0-9\- : \/]*))(?<Message>([|Message]*=[a-zA-Z0-9\- : \/]*))(?<HasException>([|HasException]*=[a-zA-Z0-9\- : \/]*))(?<ExceptionMessage>([|ExceptionMessage]*=[a-zA-Z0-9\- : \/]*))(?<CommunicationKey>([|CommunicationKey]*=[a-zA-Z0-9\- : \/]*))(?<BusinessKey>([|BusinessKey]*=[a-zA-Z0-9\- : \/]*))(?<ResourceCode>([|ResourceCode]*=[a-zA-Z0-9\- : \/]*))(?<ResourceId>([|ResourceId]*=[a-zA-Z0-9\- : \/]*))(?<ActionId>([|ActionId]*=[a-zA-Z0-9\- : \/]*))(?<TranBranchId>([|TranBranchId]*=[a-zA-Z0-9\- : \/]*))(?<ChannelId>([|ChannelId]*=[a-zA-Z0-9\- : \/]*))(?<LanguageId>([|LanguageId]*=[a-zA-Z0-9\- : \/]*))(?<UserName>([|UserName]*=[a-zA-Z0-9\- : \/]*))(?<HostName>([|HostName]*=[a-zA-Z0-9\- : \/]*))(?<HostIP>([|HostIP]*=[a-zA-Z0-9\- : \/]*))(?<ServerName>([|ServerName]*=[a-zA-Z0-9\- : \/]*))(?<ApplicationSide>([|ApplicationSide]*=[a-zA-Z0-9\- : \/]*))(?<SystemDate>([|SystemDate]*=[a-zA-Z0-9\- : \/]*))" }
  }
  date {
	match => ["timestamp", "ISO8601"]
	}
}

output {
    stdout {
		codec => rubydebug
	}
    file {
        path => "D:/Logstash/output.txt"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 12, 2021, 7:14pm UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932/2 "2021-04-12T19:14:16Z")

</div>

> [@baklavadeseni](#):
>
> `ignore_older => 0`

In Filebeat, setting ignore\_older to zero disables age-based filtering.

In logstash, setting ignore\_older to zero tells the file input to ignore any files more than zero seconds old, which usually means it ignores everything.

The file will have been added to the sincedb but I believe it will have been added with a size of zero, so if you restart logstash without the ignore\_older option it will likely read it. If not, you may have to add `sincedb_path => "NUL"` and restart again.

---

<div class="post-metadata">

**Author:** ![baklavadeseni](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\
**Post date:** [April 13, 2021, 8:16am UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932/3 "2021-04-13T08:16:39Z")

</div>

Thanks that worked! I should have misunderstand how ignore\_older works.  
I deleted it and it worked as i expected.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2021, 8:16am UTC](https://discuss.elastic.co/t/logstash-runs-and-does-nothing/269932/4 "2021-05-11T08:16:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.