Logstash Wildcard does not seem to be working?

Elastic Stack Logstash
1

I cant seem to get a wildcard to work in my config file. I have a folder with a bunch of csv files, tab delimited. I got it to run once on a single file but I cant seem to get that to work either now.

Here is my config, any help would be much appreciated. Im running windows 7, logstash-2.3.4

input {
file {
path => "X:/*.csv"
type => "poldata"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {
csv {
columns => ["REVISION", "STATUS", "STATDATE", "DOC_ID", "TITLE", "ED_DOCCAT", "CATDES", "ED_DOCTYPE", "DOCDES", "REV_ID", "IFA_PLAN", "IFA_ACTUAL", "IFA_FCST", "IFD_PLAN", "IFD_ACTUAL", "IFD_FCST", "IFC_PLAN", "IFC_ACTUAL", "IFC_FCST"]
separator => " "
}
}

output {
elasticsearch {
action => "index"
hosts => "10.12.120.60:9200"
index => "stashtest"
workers => 1
}
stdout { codec => rubydebug }
}

2

path => "X:/*.csv"

Is X: a locally mounted volume or a network share? Are you running Logstash as yourself or are you using a service account?

sincedb_path => "/dev/null"

On Windows, use "nul".

3

Hey, thanks for the reply. I will try nul, and yes it is a network share. Currently I am running it as my user

4

Are you running it as a service (as yourself) or from a command prompt?

5

Command, its not running as a service

6

If the files are older than 24 hours you need to adjust the file input's ignore_older option. Otherwise I suggest you increase logging verbosity by starting with --verbose and look for clues. For example lines with "discover" in them; one of them will indicate whether Logstash is discovering the files properly.

1 Like
7

Wow that was it, I feel stupid lol, thank you very much! Just in time for the demo in 20 mins