New to logstash: file input and stdout output not working

(Kaustabh) #1

I have a logstash config:
input {
file {
path => "/home/user/data/trace_collector.log"
filter {
grok {
match => { "message" => "%{GREEDYDATA: log}" }
output {
stdout {}

I am expecting that this will spit out the lines from the files verbatim. However, I dont see anything on the stdout when I run logstash -f xx.conf

If I change the input from file to stdin, then logstash prints out whatever I write , as expected. Am I not understanding how to use file plugin for stdin?

(Magnus B├Ąck) #2

You've probably processed the file before and then Logstash will remember what you've read and only tail the end of the file. If you want the file processed from the beginning you have to

  • delete its sincedb file (or set sincedb_path to null for the file input), and
  • set start_position to beginning.

You can confirm that this is the problem by appending a line to the log (echo foo >> /home/user/data/trace_collector.log).

File input yields no stdout output
Multiline conf file to parse log file to elasticsearch
(Kaustabh) #3

Thank you. That was it.
I was able to see foo being parsed and printed as you mentioned.

(system) #4