# Require Help in understanding logstash

**URL:** <https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322>\
**Category:** Logstash\
**Created:** [June 25, 2015, 9:48am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322 "2015-06-25T09:48:50Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [June 25, 2015, 9:48am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/1 "2015-06-25T09:48:50Z")

</div>

Hi  
I am new to logstash . I gone through some documentation about logstash and feel good to learn more about it.

The requirement which i am trying is .  
To read the log file and mathc the keyword Access in the log file and display the lines

I have tried one sample conf file to read the log file and write the data which i search as output .

My conf file follows as like this

input  
{  
file {  
path =\> ["/lee/logs/server.log"]  
}  
}  
filter {  
grok {  
match =\> ["message", "%{WORD:custom\_name}"]  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}

}

I verified by config it says OK

[lee@server1 logstash-1.5.0]$ bin/logstash -f test2.conf --configtest  
Configuration OK  
[lee@server1 logstash-1.5.0]$ bin/logstash -f test2.conf  
Logstash startup completed  
Access

I gave the input Access aftert this am not seeing any other thing.

Please help me if i am missing something to check this .

I Dont understand what is happening where i need to check as well after this

Thanks in Advance

Regards  
Lee

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2015, 9:59am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/2 "2015-06-25T09:59:15Z")

</div>

Has /lee/logs/server.log changed since you ran Logstash the last time?

---

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [June 25, 2015, 10:18am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/3 "2015-06-25T10:18:38Z")

</div>

Hi Magnus

Thank you for your reply .

I checked the file and could see there is no change to my server.log

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2015, 10:21am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/4 "2015-06-25T10:21:49Z")

</div>

Then there's nothing for Logstash to do. Logstash reads from the end of the file. If you want to reprocess old files you have to set `start_position => beginning` and either set `sincedb_path => "/dev/null"` or delete the sincedb file.

When playing around with Logstash I recommend that you use the [stdin input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-stdin.html) instead and feed Logstash data via stdin.

---

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [June 25, 2015, 11:45am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/5 "2015-06-25T11:45:20Z")

</div>

Hi Again

Correct me if i am wrong.

Stdin input is the input which will be passed in runtime . If i want to use the file how can i use it .  
Could you refer me some paths about how to use stdin input to get the data from file

thanks in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2015, 1:52pm UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/6 "2015-06-25T13:52:17Z")

</div>

With the stdin input plugin you can pass data to Logstash in any of the following two ways:

```
/path/to/logstash ... < /path/to/logfile
cat /path/to/logfile | /path/to/logstash ...

```

This is obviously not specific to Logstash but how Unix-like shells work in general.

But again, this is rarely used for real work but it's quite useful if you want to play around without dealing with sincedb files etc.

---

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [June 26, 2015, 12:31pm UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/7 "2015-06-26T12:31:04Z")

</div>

Hi Magnus

now my logstash config is reading the data of my log file and showing in the output . But with that i am getting the following information in my test as well  
A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::File path=\>["/lee/logs/server.log"], start\_position=\>"beginning", sincedb\_path=\>"/logs/", delimiter=\>"\n"\>  
Error: No such file or directory - /logs/.9788.32761.156686 {:level=\>:error}

Could you please help me on this. where i am wrong what needs to look to fix this error as well  
input  
{  
file {  
path =\> ["/lee/logs/server.log"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/logs/"  
}  
}  
filter {  
grok {  
match =\> ["message", "%{WORD:custom\_name}"]  
}  
}  
output {  
stdout {  
codec =\> line  
}

}

Thanks in Advance

---

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [June 26, 2015, 12:54pm UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/8 "2015-06-26T12:54:47Z")

</div>

I found it My sincedb path is incorrect . I rectified it now and it is working.

Thank you for helpfule hints

---

<div class="post-metadata">

**Author:** ![Renu\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renu_sharma/32/12038_2.png) [@Renu\_Sharma](https://discuss.elastic.co/u/Renu_Sharma)\
**Post date:** [September 21, 2016, 7:18am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/9 "2016-09-21T07:18:22Z")

</div>

Hi..Less\_ps  
I am getting the same error while using sincedb..could you please tell how i can correct or set my sincedb path.

---

<div class="post-metadata">

**Author:** ![Lee\_PS](https://avatars.discourse-cdn.com/v4/letter/l/65b543/32.png) [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\
**Post date:** [September 22, 2016, 4:00am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/10 "2016-09-22T04:00:19Z")

</div>

Hi There,

Hope it will solve your problem  
add sincedb\_path to the path where you have read and write access for the file.  
Example =\> "/home/user/Downloads/dbflile"  
it will create one file with name dbfile and this file keeps track of the current position of monitored log files.

Exmple  
input {  
file {  
path =\> "/home/user/Downloads/sample.csv"  
type =\> "Sample"  
start\_position =\> "beginning"  
sincedb\_path =\> "/home/user/Downloads/dbflile"  
}  
}

//Lee

---

<div class="post-metadata">

**Author:** ![Renu\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renu_sharma/32/12038_2.png) [@Renu\_Sharma](https://discuss.elastic.co/u/Renu_Sharma)\
**Post date:** [September 22, 2016, 6:40am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/11 "2016-09-22T06:40:13Z")

</div>

Hi Lee\_PS,

Thanks for the replay.  
Actually i am using Windows OS so it will be different or it will be same.

Thanks,  
Renu

---

<div class="post-metadata">

**Author:** ![Renu\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renu_sharma/32/12038_2.png) [@Renu\_Sharma](https://discuss.elastic.co/u/Renu_Sharma)\
**Post date:** [September 22, 2016, 1:24pm UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/12 "2016-09-22T13:24:01Z")

</div>

Hi,

Could you please check..this code  
if ([message] =~ /(XAPMErrorEnrichmentXB :: Order line value is)/) {  
grok {  
match =\> {"message" =\> "(?(XAPMErrorEnrichmentXB :: Order line  
value is ).{9})"}  
add\_field =\>{ "orderId" =\> "%{result}" }  
}  
}

is it correct or not?

Thanks,  
Renu

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322/13 "2017-07-06T04:37:22Z")

</div>