Logstash won't show output on console

Elastic Stack Logstash
1

This is my logstash configuration file:
<
input {
file {
path => "/home/trimslogs/trims.log"
sincedb_path => "NUL"
ignore_older => 0
}
}

filter {
grok {
match => { "message" => "([(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY:day} %{TIME:time})])([%{LOGLEVEL:type}])([%{USERNAME:application}])([%{IPV4:ip}])([%{HOSTNAME:hostname}])([%{HOSTNAME:class}])([%{USERNAME:method}])([%{BASE10NUM:linenumber}])([null])([null])([Thread[%{GREEDYDATA:threadname}]])([(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY:day} %{TIME:time})])([(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY:day} %{TIME:time})])([%{GREEDYDATA:threadname1}])([%{GREEDYDATA:error_message}])()()()()()()()()()()"}
}

}

output {
stdout { codec => rubydebug }
}

/>
When i run logstash, it won't give me output on console and remains stuck on
[INFO ] 2020-01-14 02:37:55.184 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}

2

Since you are using linux, which your path suggests. Try changing sincedb_path => "/dev/null"

3

Hello Kishore,
Thank You for the answer. However, I'm still facing the same issue. When I ran it one time before, it worked. When I tried to run it again, it remained stuck at successfully started logstash API endpoint

4

Remove the ignore_older => 0 and try.

5

Thank You so much Kishore, it worked.

6

Your welcome.

1 Like
7

Also, can you also tell me if there is some way to figure out where your grok filter is going wrong?
I ran my filter on the grok debugger here https://grokdebug.herokuapp.com/ which seems to be running fine. However, when I try to run the configuration file, I'm getting grokparsefailure

8

My advice on debugging grok patterns can be found here.

In filebeat setting ignore_older to zero means to include everything. In logstash, setting ignore_older to zero means to exclude everything more than zero seconds old, which usually excludes everything.

1 Like
9

Thankyou! The explanation really helped because I’m going to configure filebeat next. I will also checkout the grok debug link. Thanks a ton.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.