# Problem input file version 2.2.0

**URL:** <https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802>\
**Category:** Logstash\
**Created:** [February 15, 2016, 3:12pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802 "2016-02-15T15:12:35Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [February 15, 2016, 3:12pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/1 "2016-02-15T15:12:35Z")

</div>

Maurizio Maltese: Hello there everybody  
I recently updated to the last version of Logstash, taking it to the 2.2.0.  
I'm having some issues with the input file plugin. When I run Logstash and insert files that have to be uploaded to ElasticSearch in the relative folder, Logstash doesn't process all the files but one, or sometimes not even that one.  
The only way to make Logstash process files is to open and save them. Could you explain why this behaviour is different from the one in version 1.5.5?  
thank you in advance

---

<div class="post-metadata">

**Author:** ![DaanCreemers](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@DaanCreemers](https://discuss.elastic.co/u/DaanCreemers)\
**Post date:** [February 17, 2016, 4:15pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/2 "2016-02-17T16:15:14Z")

</div>

I experience the same problem after I updated to Logstash 2.2.1. This was not an issue when using Logstash 2.1.0. I would like to know how to solve this.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![yett](https://avatars.discourse-cdn.com/v4/letter/y/ed655f/32.png) [@yett](https://discuss.elastic.co/u/yett)\
**Post date:** [February 18, 2016, 11:28am UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/3 "2016-02-18T11:28:28Z")

</div>

@chicco_95@DaanCreemers

Folks,

Please try putting the value beginning in double quote for start position in input config.

Eg.

```
input {
  file {
    path => "/home/data/your-log-file.txt"
    start_position => "beginning"
  }
}

```

I spent 6 hours pulling my hair for this. It works after I added start\_position the value in the double quotes. Hope it works for you.

Cheers.

---

<div class="post-metadata">

**Author:** ![kevinava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevinava/32/7899_2.png) [@kevinava](https://discuss.elastic.co/u/kevinava)\
**Post date:** [February 22, 2016, 3:42pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/4 "2016-02-22T15:42:59Z")

</div>

@yett @DaanCreemers @chicco_95

Hi,

I face a the same issue with Logstash version 2.2.2-1 input (file plugin), this issue appared in version 2.x.x for us it seems.  
We've tried Yett's fix but that does not solve it.

After uploading a file to log directory it won't proccess the file, the only way is to run `touch filename.txt` so the date changes and thus Logstash will start prosessing the file with no problem.

This happens both in production and in a clean test enviroment.  
To clarify its been tested in production and on a clean install of CentOS 7 to see if the problem could be reproduced.

Anyone out there have a solution for this?

System info.  
CentOS Linux 7, Oracle JDK 8u66 and Logstash 2.2.2 (Repo install RPM 2.2.2-1), ES 2.2.X.

Cheers,  
Kevin

---

<div class="post-metadata">

**Author:** ![kevinava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevinava/32/7899_2.png) [@kevinava](https://discuss.elastic.co/u/kevinava)\
**Post date:** [February 22, 2016, 4:15pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/5 "2016-02-22T16:15:28Z")

</div>

Hi again,

I've found out what went "wrong", the default behavior of Logstash file input plugin seems to be ignoring files that are older than 86.400 seconds (24h) which explains why changing dates of the old files with `touch filename.txt` worked.  
This seems to be the default behavior for Logstash 2.2.X? as I've only observed the problem with Logstash 2.2.x.

Found this out by running debugging on Logstash with `logstash -f /path/to/config.conf --debug`, which pointed me in the right direction.  
[See documentation for details](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-ignore_older)

I've now added `ignore_older => 0` to the `file {}` configuration and importing of older files is working as intended again.

Hope it helps if someone else is struggeling with stalled imports of files over 24h.

Cheers,  
Kevin

---

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [February 22, 2016, 5:00pm UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/6 "2016-02-22T17:00:59Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![DaanCreemers](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@DaanCreemers](https://discuss.elastic.co/u/DaanCreemers)\
**Post date:** [February 24, 2016, 8:25am UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/7 "2016-02-24T08:25:46Z")

</div>

Thank you @kevinava. The `ignore_older` option was indeed the problem as this option was added in logstash 2.2.0.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/problem-input-file-version-2-2-0/41802/8 "2017-07-06T05:09:57Z")

</div>


