No output from json line delimited file

Elastic Stack Logstash
1

I'm trying to get Logstash 8 working with a config that works in Logstash 7. I'm not getting any output even though it works fine in v7. If I remove all the filters, I still do not get any output. When I run LS in debut I can see all the individual json lines read in, but, again, there is no output.

The input file is thousands of line delimited json individual logs. I verified that it is syntactically correct json. I've tried running logstash via Ubuntu and Windows Subsystem for Linux with the same lack of output. What am I missing?

input {
  file {
    path => ["/tmp/in.json"]
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => "json_lines"
  }
}
filter {
}
output {
  stdout { codec => rubydebug  }
}

thanks all

2

Can you share logstash logs when you run this pipeline?

I don't think much changed from 7.X to 8.X in ths input, but have you tried to remove the codec => "json_lines" ? You do not need it.

The codec description has a note that you should not use json_lines when using the file input.

NOTE: Do not use this codec if your source input is line-oriented JSON, for example, redis or file inputs. Rather, use the json codec. More info: This codec is expecting to receive a stream (string) of newline terminated lines. The file input will produce a line string without a newline. Therefore this codec cannot work with line oriented inputs.

Also, if possible share some sample message from your file so it is possible to try to replicate your issue.

3

Thanks, I kinda figured it out. I switched to stdin and just pasted in logs from the same file I wanted to test and that worked fine.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.