Not able to use since_db properly

I am trying to insert data in elasticsearch using logstash but when i update a file and again process it the events get duplicated when i only want the newly added entries to get indexed, for this i am trying to use sincedb_path but i am making some mistake. Can anybody help me in finding the mistake?. Any help is appreciated. Thanks
My input filter looks like this:

input{
file
{
	mode => "read"
	file_completed_action => "log"
	file_completed_log_path => "C:/logstash-7.1.1/log.txt"
	path => "F:/PRANAY/project/Store Mg C++/sales.csv"
	sincedb_path => "F:/PRANAY/project/Store Mg C++/salesincedb.txt"
	start_position => "beginning"
}}

It would be really great if someone could explain when to use start_position and mode and which value to use.

How are you updating the file? The file input tracks files by their file id (similar to an inode number on UNIX), not by their name. If you create a new file with the same name but a different id the file input will see it as a new file.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.