# Logstash stopped running after first run
**URL:** https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782
**Category:** Logstash
**Created:** [June 13, 2018, 7:19pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782 "2018-06-13T19:19:11Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [June 13, 2018, 7:19pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/1 "2018-06-13T19:19:11Z")
The data loaded the first time, not sure what happened.
I get this notification:
> [2018-06-13T14:28:34,944][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
Then it just sits and waits. This is very confusing.
Sometimes I need the type, sometimes I don't.
Here is my config:
input {
```
file {
path => ["C:\Users\me\Desktop\2018-AS-Tracking-Visit.csv"]
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["xxxxxxxxxxxxxxxxxxxxxxxxxx:9200"]
index => "tracking"
user=>"xxxxxx"
password=>"xxxxxxxxxxxxxxxxxxx"
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2018, 7:51pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/2 "2018-06-13T19:51:45Z")
A file input records how much of the file it has read in the sincedb. Once it has read the file once the start\_position is ignored and if logstash is restarted it will start from the position in the sincedb. It will sit and wait for new data to be appended to the file. So it sounds to me like this is working as expected.
If you want to re-read the whole file every time then set the sincedb\_path to "nul".
---
### Author:  [@CDR](https://discuss.elastic.co/u/CDR)
#### Post date: [June 13, 2018, 7:59pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/3 "2018-06-13T19:59:39Z")
Is there a file called null you can set the sincedb\_path to on a Windows machine? I know that for my Linux machines I write to /dev/null, but wasn't sure if there was one or WIndows.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 13, 2018, 8:13pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/4 "2018-06-13T20:13:06Z")
It's called "nul" (yes, not "null").
---
### Author:  [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [June 13, 2018, 8:37pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/5 "2018-06-13T20:37:59Z")
Thanks!
Forgot all about that!
---
### Author:  [@CDR](https://discuss.elastic.co/u/CDR)
#### Post date: [June 13, 2018, 8:56pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/6 "2018-06-13T20:56:41Z")
Do you simply send set the path to just "nul"?
---
### Author:  [@mc1392](https://discuss.elastic.co/u/mc1392)
#### Post date: [June 13, 2018, 11:46pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/7 "2018-06-13T23:46:04Z")
sincedb\_path =\> "nul"
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2018, 11:46pm UTC](https://discuss.elastic.co/t/logstash-stopped-running-after-first-run/135782/8 "2018-07-11T23:46:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.