Logstash struck after Pipeline main started.. No output printed and nothing sent to elastic search

Elastic Stack Logstash
1

I am using logstash-2.3.3. when i run "logstash -f logstash-workday.conf" it is struck and no output is being displayed.
C:\logstash-2.3.3\bin>logstash -f logstash-workday.conf
io/console not supported; tty will not be manipulated
Settings: Default pipeline workers: 8
Pipeline main started

logstash-workday.conf : (Input is an file containing some log information and XML content.)
input {
file {

    path => "C:\logstash-2.3.3\bin\test.xml"
     
    codec => multiline {
        # Grok pattern names are valid! :)
        pattern => "^%{...}"
        negate => true
        what => previous
        }
  }

}

filter{
xml{
}
}

output{
stdout {
codec => rubydebug
}
}

When i ran "logstash -f logstash-workday.conf --debug" I found these in the logs :
{:timestamp=>"2016-06-21T11:03:07.383000-0700", :message=>"Reading config file", :config_file=>"C:/logstash-2.3.3/bin/logstash-workday.conf", :level=>:debug, :file=>"/logstash-2.3.3/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/config/loader.rb", :line=>"69", :method=>"local_config"}
{:timestamp=>"2016-06-21T11:03:07.709000-0700", :message=>"Plugin not defined in namespace, checking for plugin file", :type=>"codec", :name=>"multiline", :path=>"logstash/codecs/multiline", :level=>:debug, :file=>"/logstash-2.3.3/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/plugin.rb", :line=>"76", :method=>"lookup"}..... (Its a very long log file :frowning: )

Thanks in advance.

2

Is C:\logstash-2.3.3\bin\test.xml constantly being updated? Because the file plugin reads anything new that is appended to the file. If you want to start from the beginning of the file you need to use the directive start_position => "beginning".
Also seeing as you have already run this config, logstash creates a .sincedb_ file that you will need to delete. Logstash uses this file to remember where it left off if you were to restart the program.

3

No the file is not being constantly updated. So i added
ignore_older => 0
the directive start_position => "beginning" is already present and
each time I am deleting the .sincedb_file before i execute the logstash.

4

I found the issue.
The test.xml file has only one event.
Now when the codec is executed in the input plugin, it waits for the next event then only the previous one will be published/printed.
codec => multiline {
# Grok pattern names are valid! :slight_smile:
pattern => "^%{...}"
negate => true
what => previous
}
As soon as I added one more event, BOOM the output appeared.

Thank you :slight_smile: