I have a use case where I want to take a complete file, and ship it once to logstash. (Not tail it.) Is there a shipper that does this?
The file input can read files from the beginning (and when it reaches the end it continues to tail them). But apart from using the stdin input and piping the file to Logstash there's no way to ship a file and e.g. shut down Logstash and/or delete the file that was just read.
I read in some thread that it may be possible to do:
cat logfile | logstash-forwarder
Does anyone know if that is true?
Yes, you can do that with either Logstash or logstash-forwarder. The drawback is that if the process is interrupted the tools won't be able to help you resume the processing from where it was interrupted.
Looks like this project would be perfect, however it is fairly old: