Probem with file imput

Hello everyone,
I'm having a strange behaviour with my Logstash. I'm stucked on the following problem:
I had a one flow configured where I had file input and that worked brilliant.
Then I added to my flow udp input....

When I added that I started expirenced a problem with my file input. upd records was without any problems processed, but my file logs processing died. When I restarted logstash service file processing started working again. When all file was processed and deleted from folders (file_completed_action => "delete") than the new one pushed to the folder over ssh session are not processed. When logstash service is again restarted - then files are correct processed.

I decided to split to separate pipelines and divide my config to the two separated configuration files. so far so good - when file data was on the configured path works again: files was processed and upd input works fine. The 'happienes' took not too long :\ when my folder was empty from whole files and new files comes - they was not processed.
Had anyone that strange behaviour with file input? How get rid with that kind of problem?


This is very likely due to inode reuse. See the posts linked to in this thread. There are various workarounds suggested in some of those.

There is no good solution. You could change the completion action from delete to log, then have an external script truncate the files as they are logged.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.