New to logstash: file input and stdout output not working

Elastic Stack Logstash
1

I have a logstash config:
input {
file {
path => "/home/user/data/trace_collector.log"
}
}
filter {
grok {
match => { "message" => "%{GREEDYDATA: log}" }
}
}
output {
stdout {}
}

I am expecting that this will spit out the lines from the files verbatim. However, I dont see anything on the stdout when I run logstash -f xx.conf

If I change the input from file to stdin, then logstash prints out whatever I write , as expected. Am I not understanding how to use file plugin for stdin?

2

You've probably processed the file before and then Logstash will remember what you've read and only tail the end of the file. If you want the file processed from the beginning you have to

  • delete its sincedb file (or set sincedb_path to null for the file input), and
  • set start_position to beginning.

You can confirm that this is the problem by appending a line to the log (echo foo >> /home/user/data/trace_collector.log).

1 Like
3

Thank you. That was it.
I was able to see foo being parsed and printed as you mentioned.