# Parsing logs from file

**URL:** <https://discuss.elastic.co/t/parsing-logs-from-file/163488>\
**Category:** Logstash\
**Created:** [January 9, 2019, 9:25am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488 "2019-01-09T09:25:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrVladii](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@mrVladii](https://discuss.elastic.co/u/mrVladii)\
**Post date:** [January 9, 2019, 9:25am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488/1 "2019-01-09T09:25:27Z")

</div>

Hello, i tried to parse logs from file and send data to elasticsearch. And for some reason, I do not parse file.

1. I use the following "logstash.conf" file:  
input {  
file{  
path=\>"D:\Project\logs.log"  
start\_position =\> "beginning" }}  
filter {  
grok { match=\> {"message"=\> "(%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message})"}}  
if "\_grokparsefailure" in [tags]{ drop{} }  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "logs-%{+YYYY.MM.dd}"}  
stdout { codec =\> rubydebug }}

2. There is data from my "logs.log" file:

2018-12-06 23:00:00,068 INFO {Cluster} ETK-3-U-SET01 10.78.80.57 Alive 8.011134s  
2018-12-06 23:00:00,068 INFO {External} - no external modules loaded yet, complete test transaction to load them -  
2018-12-06 23:00:00,068 WARN {Job} END

1. And i have the following output in logstash:

[2019-01-09T12:20:49,075][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//localhost:9200](https://localhost:9200)"]}  
[2019-01-09T12:20:49,100][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2019-01-09T12:20:49,129][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2019-01-09T12:20:49,680][INFO][logstash.inputs.file] No sincedb\_path set, generating one based on the "path" setting {:sincedb\_path=\>"D:/Programs/ELC/logstash654/data/plugins/inputs/file/.sincedb\_2844bc93237b9dafac4fa003179d4180", :path=\>["D:\Project\logs.log"]}  
[2019-01-09T12:20:49,723][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x6e9597af run\>"}  
[2019-01-09T12:20:49,792][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}  
[2019-01-09T12:20:49,799][INFO][filewatch.observingtail] START, creating Discoverer, Watch with file and sincedb collections  
[2019-01-09T12:20:50,105][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

Please help me solve this issue.

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [January 9, 2019, 11:51am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488/2 "2019-01-09T11:51:15Z")

</div>

> [@mrVladii](#):
>
> path=\>"D:\Project\logs.log"

Make sure to change the path as shown below,

> path=\>"D:/Project/logs.log"

In the output file observed that you have used sincedb\_path but not found in input config file..??  
By default for windows use,

> sincedb\_path =\> "NUL"

---

<div class="post-metadata">

**Author:** ![sky0](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@sky0](https://discuss.elastic.co/u/sky0)\
**Post date:** [January 29, 2019, 6:24am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488/3 "2019-01-29T06:24:39Z")

</div>

thanks balumurari1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 6:24am UTC](https://discuss.elastic.co/t/parsing-logs-from-file/163488/4 "2019-02-26T06:24:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.