Logstash sincedb_path is not working

Elastic Stack Logstash
1

This is not working. There is no output. I want to use sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6

sudo rm -rf /mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6

sudo /usr/share/logstash/bin/logstash -e 'input { file { path => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log"  sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6" } } output { stdout { codec => rubydebug } }' --verbose

There are no sincedb files in default directory.

ls /usr/share/logstash/data/plugins/inputs/file
no files

This is working. I don't want to use start_position => beginning sincedb_path => "/dev/null"

sudo /usr/share/logstash/bin/logstash -e 'input { file { path => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log"  start_position => beginning sincedb_path => "/dev/null" } } output { stdout { codec => rubydebug } }' --verbose  

{
      "@version" => "1",
          "host" => "hostname",
          "path" => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log",
    "@timestamp" => 2018-02-07T19:24:31.758Z,
       "message" => "Caused by: java.io.IOException: null"
}
2

But your second attempt also has start_position => "beginning".

3

@magnusbaeck

Thanks.

I want to use

sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6

I don't want to use

start_position => beginning sincedb_path => "/dev/null"

4

If you want files to be read from the beginning you need start_position => "beginning", but that's unrelated to the sincedb_path setting. Over and out.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.