Logstash Runs And Does Nothing

In Filebeat, setting ignore_older to zero disables age-based filtering.

In logstash, setting ignore_older to zero tells the file input to ignore any files more than zero seconds old, which usually means it ignores everything.

The file will have been added to the sincedb but I believe it will have been added with a size of zero, so if you restart logstash without the ignore_older option it will likely read it. If not, you may have to add sincedb_path => "NUL" and restart again.