From the evidence I've seen Logstash works as expected. Please read the file input documentation and make sure you understand how sincedb works. If you increase Logstash's logging verbosity by starting it with --verbose it'll tell you more about what's going on with the sincedb files.