Read log file that is feed from top not from bottom

Elastic Stack Logstash
1

Hi folks.
I have a log file that is feed from top (new entries are added from top), Is there a way to let know logstash read this file from top?

Thanks in advance.

2

Hey exorcista,

there is a field in the input configuration called "start_position".

Here the URL of the documentation:
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-start_position

On default, the start position of File Input is on the end of the file. If you change the configuration to "beginning", Logstash will read the file from top.

BUT take care ! The change affects only for "new" logfiles that weren't analyzed before. If you want to do this with already analyzed files, you have to change the sincedb path to a new file.

I hope i could help you =)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.