# Ship a completed logfile?

**URL:** <https://discuss.elastic.co/t/ship-a-completed-logfile/26910>\
**Category:** Logstash\
**Created:** [August 5, 2015, 5:19pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910 "2015-08-05T17:19:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bruce\_Lysik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruce_lysik/32/2037_2.png) [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\
**Post date:** [August 5, 2015, 5:19pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/1 "2015-08-05T17:19:06Z")

</div>

I have a use case where I want to take a complete file, and ship it once to logstash. (Not tail it.) Is there a shipper that does this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 5, 2015, 7:37pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/2 "2015-08-05T19:37:55Z")

</div>

The file input can read files from the beginning (and when it reaches the end it continues to tail them). But apart from using the stdin input and piping the file to Logstash there's no way to ship a file and e.g. shut down Logstash and/or delete the file that was just read.

---

<div class="post-metadata">

**Author:** ![Bruce\_Lysik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruce_lysik/32/2037_2.png) [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\
**Post date:** [August 5, 2015, 8:23pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/3 "2015-08-05T20:23:14Z")

</div>

I read in some thread that it may be possible to do:

cat logfile | logstash-forwarder

Does anyone know if that is true?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 5, 2015, 8:38pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/4 "2015-08-05T20:38:46Z")

</div>

Yes, you can do that with either Logstash or logstash-forwarder. The drawback is that if the process is interrupted the tools won't be able to help you resume the processing from where it was interrupted.

---

<div class="post-metadata">

**Author:** ![Bruce\_Lysik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruce_lysik/32/2037_2.png) [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\
**Post date:** [August 5, 2015, 8:48pm UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/5 "2015-08-05T20:48:12Z")

</div>

Looks like this project would be perfect, however it is fairly old:

> **[kitchen/pipestash](https://github.com/kitchen/pipestash)**
>
> pipestash - read from a pipe, ship to logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/ship-a-completed-logfile/26910/6 "2017-07-06T05:32:48Z")

</div>

Closed on July 6, 2017, 5:32am UTC