# Logstash service discover\_files {:count=\>0}

**URL:** <https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376>\
**Category:** Logstash\
**Created:** [October 11, 2022, 7:48pm UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376 "2022-10-11T19:48:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![fantastas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fantastas/32/111943_2.png) [@fantastas](https://discuss.elastic.co/u/fantastas)\
**Post date:** [October 11, 2022, 7:48pm UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/1 "2022-10-11T19:48:31Z")

</div>

hello,

i have an issue i can't figure out. I am also not sure how logstash **sincedb\_path** works too so if someone could help me understand - I'd highly appreciate.

I am running ELK on RedHat Linux virtual machine. If i am runing logstash file in terminal:

```auto
sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/new.conf 

```

everything works and I even see logs in kibana which is awesome btw.

However, if i try to run it as a service everything stops here with info logging option:

```auto
[2022-10-11T22:42:26,668][INFO][filewatch.observingtail][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] START, creating Discoverer, Watch with file and sincedb collections
[2022-10-11T22:42:26,681][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

```

trace logging option gives me this:

```auto
[2022-10-11T23:16:07,000][TRACE][filewatch.discoverer][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:07,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:08,001][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:08 +0300)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] non_atomic_write: {:time=>2022-10-11 23:16:08 +0300}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:12,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:17,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:22,005][TRACE][filewatch.discoverer][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:22,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:23,006][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:23,006][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:23 +0300)

```

which I guess means that it can't find my json file. and also  
**writing sincedb (delta since last write = 15)** value doesn't  
change.

I have tried changing ownership of files to logstash user but still no luck.  
Maybe someone had a similar issue and could help me out.

Thanks in advance.

M.

```auto

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 11, 2022, 9:12pm UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/2 "2022-10-11T21:12:19Z")

</div>

You need to share your configuration.

Also, share the `pipelines.yml` file.

---

<div class="post-metadata">

**Author:** ![fantastas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fantastas/32/111943_2.png) [@fantastas](https://discuss.elastic.co/u/fantastas)\
**Post date:** [October 11, 2022, 9:15pm UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/3 "2022-10-11T21:15:35Z")

</div>

new.conf:

```auto
input {
file {
path => "/home/mariussur/logstash/c.json"
codec => "json"
sincedb_path => "/dev/null"
start_position => "beginning"
}
}

filter {}

output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http:// ***.**.*.**:9200/"]
user => " *******"
password => " *******"
index => "some-tag"
action => "create"
}
}

```

pipelines.yml:

```auto
- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 12, 2022, 5:37am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/4 "2022-10-12T05:37:10Z")

</div>

> [@fantastas](#):
>
> `path => "/home/mariussur/logstash/c.json"`

When you run as a service, Logstash will run under the `logstash` user, which will not have permissions to read this file.

Giving permissions to the file `c.json` will not solve the issue because the `logstash` user would still not have permissions to the path and I do not recommend changing the permissions of a user path.

You should put the file in another path where the Logstash user will have permissions to read it.

---

<div class="post-metadata">

**Author:** ![fantastas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fantastas/32/111943_2.png) [@fantastas](https://discuss.elastic.co/u/fantastas)\
**Post date:** [October 12, 2022, 6:21am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/5 "2022-10-12T06:21:05Z")

</div>

Brilliant, thank you so much.

---

<div class="post-metadata">

**Author:** ![fantastas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fantastas/32/111943_2.png) [@fantastas](https://discuss.elastic.co/u/fantastas)\
**Post date:** [October 12, 2022, 6:33am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/6 "2022-10-12T06:33:30Z")

</div>

Maybe you could help me understand how sincedb works as well?  
I have tried adding new lines to c.json file while the service is running but  
it does not detect change.

```auto
[2022-10-12T09:32:21,829][TRACE][filewatch.tailmode.processor][main][bae877d8831ddf84ad30d1d61739ea69f9829aa6d10cdae2e5542394d7ed1f4c] process_restat_for_watched_and_active
[2022-10-12T09:32:21,830][TRACE][filewatch.tailmode.processor][main][bae877d8831ddf84ad30d1d61739ea69f9829aa6d10cdae2e5542394d7ed1f4c] process_rotation_in_progress
[2022-10-12T09:32:21,830][TRACE][filewatch.tailmode.processor][main][bae877d8831ddf84ad30d1d61739ea69f9829aa6d10cdae2e5542394d7ed1f4c] process_watched
[2022-10-12T09:32:21,830][TRACE][filewatch.tailmode.processor][main][bae877d8831ddf84ad30d1d61739ea69f9829aa6d10cdae2e5542394d7ed1f4c] process_active
[2022-10-12T09:32:21,830][TRACE][filewatch.tailmode.processor][main][bae877d8831ddf84ad30d1d61739ea69f9829aa6d10cdae2e5542394d7ed1f4c] process_active no change {:path=>"c.json"}

```

**Already figured out, that you have to truncate c.json before adding new data and then it works as expected.**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2022, 6:34am UTC](https://discuss.elastic.co/t/logstash-service-discover-files-count-0/316376/7 "2022-11-09T06:34:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.