# Logstash Wildcard does not seem to be working?

**URL:** <https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070>\
**Category:** Logstash\
**Created:** [August 26, 2016, 6:54pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070 "2016-08-26T18:54:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![DustinVest](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@DustinVest](https://discuss.elastic.co/u/DustinVest)\
**Post date:** [August 26, 2016, 6:54pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/1 "2016-08-26T18:54:14Z")

</div>

I cant seem to get a wildcard to work in my config file. I have a folder with a bunch of csv files, tab delimited. I got it to run once on a single file but I cant seem to get that to work either now.

Here is my config, any help would be much appreciated. Im running windows 7, logstash-2.3.4

input {  
file {  
path =\> "X:/\*.csv"  
type =\> "poldata"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
csv {  
columns =\> ["REVISION", "STATUS", "STATDATE", "DOC\_ID", "TITLE", "ED\_DOCCAT", "CATDES", "ED\_DOCTYPE", "DOCDES", "REV\_ID", "IFA\_PLAN", "IFA\_ACTUAL", "IFA\_FCST", "IFD\_PLAN", "IFD\_ACTUAL", "IFD\_FCST", "IFC\_PLAN", "IFC\_ACTUAL", "IFC\_FCST"]  
separator =\> " "  
}  
}

output {  
elasticsearch {  
action =\> "index"  
hosts =\> "10.12.120.60:9200"  
index =\> "stashtest"  
workers =\> 1  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 27, 2016, 2:05pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/2 "2016-08-27T14:05:59Z")

</div>

> path =\> "X:/\*.csv"

Is X: a locally mounted volume or a network share? Are you running Logstash as yourself or are you using a service account?

> sincedb\_path =\> "/dev/null"

On Windows, use "nul".

---

<div class="post-metadata">

**Author:** ![DustinVest](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@DustinVest](https://discuss.elastic.co/u/DustinVest)\
**Post date:** [August 27, 2016, 9:05pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/3 "2016-08-27T21:05:48Z")

</div>

Hey, thanks for the reply. I will try nul, and yes it is a network share. Currently I am running it as my user

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 28, 2016, 1:13pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/4 "2016-08-28T13:13:04Z")

</div>

Are you running it as a service (as yourself) or from a command prompt?

---

<div class="post-metadata">

**Author:** ![DustinVest](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@DustinVest](https://discuss.elastic.co/u/DustinVest)\
**Post date:** [August 28, 2016, 9:34pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/5 "2016-08-28T21:34:49Z")

</div>

Command, its not running as a service

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 29, 2016, 5:23am UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/6 "2016-08-29T05:23:42Z")

</div>

If the files are older than 24 hours you need to adjust the file input's `ignore_older` option. Otherwise I suggest you increase logging verbosity by starting with `--verbose` and look for clues. For example lines with "discover" in them; one of them will indicate whether Logstash is discovering the files properly.

---

<div class="post-metadata">

**Author:** ![DustinVest](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@DustinVest](https://discuss.elastic.co/u/DustinVest)\
**Post date:** [August 29, 2016, 6:09pm UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/7 "2016-08-29T18:09:05Z")

</div>

Wow that was it, I feel stupid lol, thank you very much! Just in time for the demo in 20 mins

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/logstash-wildcard-does-not-seem-to-be-working/59070/8 "2017-07-06T04:41:03Z")

</div>