Nothing Happens After Restart

Elastic Stack Logstash
1

Hello,

I've tried some modifications on my logstash config file and when I restart logstash nothing happens after "Pipeline main started". If I do a roll back on the config file, it's the same problem.
Logstash not starting correctly as a service. But if I run logstash in verbose mode with the user root, it's working.
(My syslog-ng still running)
Can you help me for this problem ?

Thanks in advance.

2

What does your config look like then?

3

This is my working config file :
input{
file{
path => "/home/logs/firewall/heimdall.log"
type => "linux-syslog"
}
}
filter {
grok {
match => {
"message" => '%{SYSLOGTIMESTAMP} %{IPV4:iphost} %{GREEDYDATA:fgtlogmsg}'
}
}
kv {
source => "fgtlogmsg"
}
mutate {
remove_field => [ "message" , "fgtlogmsg", "vd", "host", "logid" ]
}
}
output {
elasticsearch {
codec => "json"
hosts => ["127.0.0.1:9200"]
index => "heimdall"
}
# stdout { codec => rubydebug }
}

If I restart the service, this never starting correctly with "service logstash restart"

4

It's likely this then - https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#_tracking_of_current_position_in_watched_files

5

I have not specified any file but I have some file in /var/lib/logstash named .sincedb_*.
So, normally it's ok ?