Simple config does not work: file input

Elastic Stack Logstash
1

I apologize for a stupid question, but I got stuck: the following simple config does not parse the input log-file (LS v.7.3.1):

input {
  file {
    path => ["C:\temp\solr.log.3"]
	#start_position => "beginning"
	sincedb_path => "NUL"
	ignore_older => 0
	mode => "read"
  }
}

filter {
}

output {
	stdout {
		codec => json_lines
	}
}

Start LS:

C:\programms\logstash\bin\logstash -f solr.conf

and nothing gets parsed:

Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=lcd
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to C:/programms/logstash/logs which is now configured via log4j2.properties
[2019-09-10T18:55:59,972][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-09-10T18:55:59,992][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.3.1"}
[2019-09-10T18:56:01,145][INFO ][org.reflections.Reflections] Reflections took 31 ms to scan 1 urls, producing 19 keys and 39 values
[2019-09-10T18:56:01,889][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge] A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster_uuids. This may result in invalid serialization.  It is recommended to log an issue to the responsible developer/development team.
[2019-09-10T18:56:01,889][INFO ][logstash.javapipeline    ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, :thread=>"#<Thread:0x32816e05 run>"}
[2019-09-10T18:56:02,696][INFO ][logstash.javapipeline    ] Pipeline started {"pipeline.id"=>"main"}
[2019-09-10T18:56:02,758][INFO ][filewatch.observingread  ] START, creating Discoverer, Watch with file and sincedb collections
[2019-09-10T18:56:02,788][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-09-10T18:56:03,241][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

the debug output does not display anything useful!

It should be a stupid mistake, but what exactly?..
Any hint - much appreciated!
Thanks!

2

Do not use backslash in the path option of a file input. Use forward slash. Also, remove "ignore_older => 0". That says to ignore any files more than zero seconds old, which is all files.

1 Like
3

I had tried forward slash, but it hadn't changed anything and I replaced them back.
Ok, I changed the slashes to forward ones and commented out ignore_older - and it worked!
Strange, but I always used ignore_older with LS v.5.x -and it worked. Something changed...

next issue: if I start this config again - it does not read lines again!

input {
  file {
    path => ["C:/temp/solr.log.3"]
	sincedb_path => "NUL"
	mode => "read"
  }
}

Do you have another ideas? Thank you!

There is only one LS-related history file in the HOME directory: .logstash_jdbc_last_run

4

In read mode the default file_completed_action is delete, so I would expect it to have deleted the file after reading it.

1 Like
5

yes, that was another pitfall :frowning: it deletes files per default!
Thank you very much for your support!

P.S. I better say nothing about LS.....

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.