Then there's nothing for Logstash to do. Logstash reads from the end of the file. If you want to reprocess old files you have to set start_position => beginning and either set sincedb_path => "/dev/null" or delete the sincedb file.
When playing around with Logstash I recommend that you use the stdin input instead and feed Logstash data via stdin.
Stdin input is the input which will be passed in runtime . If i want to use the file how can i use it .
Could you refer me some paths about how to use stdin input to get the data from file
now my logstash config is reading the data of my log file and showing in the output . But with that i am getting the following information in my test as well
A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::File path=>["/lee/logs/server.log"], start_position=>"beginning", sincedb_path=>"/logs/", delimiter=>"\n">
Error: No such file or directory - /logs/.9788.32761.156686 {:level=>:error}
Could you please help me on this. where i am wrong what needs to look to fix this error as well
input
{
file {
path => ["/lee/logs/server.log"]
start_position => "beginning"
sincedb_path => "/logs/"
}
}
filter {
grok {
match => [ "message", "%{WORD:custom_name}" ]
}
}
output {
stdout {
codec => line
}
Hope it will solve your problem
add sincedb_path to the path where you have read and write access for the file.
Example => "/home/user/Downloads/dbflile"
it will create one file with name dbfile and this file keeps track of the current position of monitored log files.
Could you please check..this code
if ([message] =~ /(XAPMErrorEnrichmentXB :: Order line value is)/) {
grok {
match => {"message" => "(?(XAPMErrorEnrichmentXB :: Order line
value is ).{9})"}
add_field =>{ "orderId" => "%{result}" }
}
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.