hi,
we're using logstash 2.2.2
I'm trying to feed logstash with kibana logs, kibana log looks like:
{"type":"log","@timestamp":"2016-03-13T10:05:30+00:00","tags":["status","plugin:elasticsearch","info"],"pid":15856,"name":"plugin:elasticsearch","state":"green","message":"Status changed from yellow to green - Kibana index ready","prevState":"yellow","prevMsg":"Waiting for Elasticsearch"}
Unless you delete the sincedb file /var/log/kibana/kibana.stdout won't be reprocessed since Logstash think it's already done with that file. If new data is added to Kibana's logfile that data should show up though.
Logstash's file input is designed to continuously monitor log files and send newly added data but not resend old data. When you restart Logstash after changing the configuration Logstash won't reprocess the file again unless you delete Logstash's sincedb file which contains the current position in the log files it reads. The file input documentation explains how this works.
From the evidence I've seen Logstash works as expected. Please read the file input documentation and make sure you understand how sincedb works. If you increase Logstash's logging verbosity by starting it with --verbose it'll tell you more about what's going on with the sincedb files.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.