My config file in logstash/conf.d directory contains a sincedb_path directive in an input/file section :
path => "/var/log/myfile"
sincedb_path => "/root/sincedb/sincedb.db"
... but no sincedb.db file is not created when logstash runs. The rights are Ok in /root/sincedb directory (logstash:logstash).
I activated --debug logs in logstash VM :
- With this configuration, a trace saying "file grew : /var/log/myfile: old size 0, new size 330851 ..." is continuously displayed in log file althgough "myfile" does not change ... Probably linked to the fact that no sincedb file are created, ... but nonethelees, logstash does produce any additionnal output (so it knows, don't know how without sincedb file, that no new line have been appended)
- When I append a new line in "myfile", log says "file grew : /var/log/myfile: old size 0, new size 331449 ..." followed by everal log lines "Received line" ... ending by an exception in plugin Logstash::Inputs::File" ... this exception is a ENOENT one,
It seems thats logstash tries to create a file whose name is
/root/sincedb/sincedb.db.15506.2290.753894 ... and fails to create it ...
2290 is the logstash JVM PID. For each new log, I always have the "15506" value (thought it was the input file inode .. but it is not ...), and "753894" changes for each new log (suppose it is a timestamp at the time it tries to create the file).
Can anyone explain what happens there : why logstash cannot create the file, and explain the values used to build the filename ?