im using the example from the documentation.
path => "H:\logstash\zipped_folders\logstash-2.3.1\bin\first-pipeline-data"
start_position => beginning #1
#ignore_older => 0
this is my .conf file
after I run the .conf file, the only output that I see is:
Settings: Default pipeline workers: 4
Pipeline main started
how do I see the output?
by default , Logstash will not read files if the last modification made is older than 24 hours. You might want to check the sincedb file too: if your file has already been read by Logstash, unless removing this sincedb file, you have to modify your input file. Indeed, spetting the
"beginning" just means that, for the first read of the file, Logstash will start at the beginning of the file instead starting at the end and waiting for modification to process. It doesn't mean that Logstash will read the file from the beginning every time you launch it.
By default, the sincedb file is written to some path matching
$HOME/.sincedb* . (see here for more information on file plugin and the sincedb_path setting;https://www.elastic.co/guide/en/logstash/2.3/plugins-inputs-file.html#plugins-inputs-file-sincedb_path
Hope this will help.