Ship a completed logfile?

(Bruce Lysik) #1

I have a use case where I want to take a complete file, and ship it once to logstash. (Not tail it.) Is there a shipper that does this?

(Magnus Bäck) #2

The file input can read files from the beginning (and when it reaches the end it continues to tail them). But apart from using the stdin input and piping the file to Logstash there's no way to ship a file and e.g. shut down Logstash and/or delete the file that was just read.

(Bruce Lysik) #3

I read in some thread that it may be possible to do:

cat logfile | logstash-forwarder

Does anyone know if that is true?

(Magnus Bäck) #4

Yes, you can do that with either Logstash or logstash-forwarder. The drawback is that if the process is interrupted the tools won't be able to help you resume the processing from where it was interrupted.

(Bruce Lysik) #5

Looks like this project would be perfect, however it is fairly old:

(system) #6