# Simple config does not work: file input

**URL:** <https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941>\
**Category:** Logstash\
**Created:** [September 10, 2019, 5:00pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941 "2019-09-10T17:00:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 10, 2019, 5:00pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/1 "2019-09-10T17:00:49Z")

</div>

I apologize for a stupid question, but I got stuck: the following simple config does not parse the input log-file (LS v.7.3.1):

```auto
input {
  file {
    path => ["C:\temp\solr.log.3"]
	#start_position => "beginning"
	sincedb_path => "NUL"
	ignore_older => 0
	mode => "read"
  }
}

filter {
}

output {
	stdout {
		codec => json_lines
	}
}

```

Start LS:

```
C:\programms\logstash\bin\logstash -f solr.conf

```

and nothing gets parsed:

```auto
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=lcd
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to C:/programms/logstash/logs which is now configured via log4j2.properties
[2019-09-10T18:55:59,972][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-09-10T18:55:59,992][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.3.1"}
[2019-09-10T18:56:01,145][INFO][org.reflections.Reflections] Reflections took 31 ms to scan 1 urls, producing 19 keys and 39 values
[2019-09-10T18:56:01,889][WARN][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge] A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2019-09-10T18:56:01,889][INFO][logstash.javapipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, :thread=>"#<Thread:0x32816e05 run>"}
[2019-09-10T18:56:02,696][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=>"main"}
[2019-09-10T18:56:02,758][INFO][filewatch.observingread] START, creating Discoverer, Watch with file and sincedb collections
[2019-09-10T18:56:02,788][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-09-10T18:56:03,241][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}

```

the debug output does not display anything useful!

It should be a stupid mistake, but what exactly?..  
Any hint - much appreciated!  
Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2019, 5:08pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/2 "2019-09-10T17:08:33Z")

</div>

Do not use backslash in the path option of a file input. Use forward slash. Also, remove "ignore\_older =\> 0". That says to ignore any files more than zero seconds old, which is all files.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 10, 2019, 5:25pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/3 "2019-09-10T17:25:19Z")

</div>

I had tried forward slash, but it hadn't changed anything and I replaced them back.  
Ok, I changed the slashes to forward ones and commented out `ignore_older` - and it worked!  
Strange, but I always used `ignore_older` with LS v.5.x -and it worked. Something changed...

next issue: if I start this config again - it does not read lines again!

```auto
input {
  file {
    path => ["C:/temp/solr.log.3"]
	sincedb_path => "NUL"
	mode => "read"
  }
}

```

Do you have another ideas? Thank you!

There is only one LS-related history file in the HOME directory: `.logstash_jdbc_last_run`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2019, 5:28pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/4 "2019-09-10T17:28:25Z")

</div>

In read mode the default file\_completed\_action is delete, so I would expect it to have deleted the file after reading it.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 10, 2019, 5:37pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/5 "2019-09-10T17:37:57Z")

</div>

yes, that was another pitfall ☹ it deletes files per default!  
Thank you very much for your support!

P.S. I better say nothing about LS.....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2019, 5:37pm UTC](https://discuss.elastic.co/t/simple-config-does-not-work-file-input/198941/6 "2019-10-08T17:37:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.