Start_position => "end"

Elastic Stack Logstash
1

Hello,

I used to set the start position to "beginning" but now I want to set the value to "end". The problem is that after setting the start_position to "end" logstash does not parse my logs anymore.

I already tried to erase the start_position line from my config file beacause "end" is the default value but the result is the same.

2

What version of the file input are you using?

3

I use logstash 6.3 if that's your question. There is my input config. If I change the "end" to "beginning" it works.

input {
file{
path => "C:\Users\u1\Docs\Elasticsearch\Logs\CDR-SBC*"
start_position => "end"
sincedb_path => "/dev/null"
tags => ["cdr"]
codec => plain {
charset => "ISO-8859-1"
}
}
}

4

the plugin version.

bin/logstash-plugin list --verbose | grep "input-file"

5

I'm using logstash-input-file 4.0.5

I just tied to update my plugins but I got a error :

Error Bundler::HTTPError, retrying 1/10
Could not fetch specs from https://rubygems.org/

6

You need v4.1.5. A regression bug was fixed in that version that concerned the handling of start_position.

Is your Logstash machine connected to the internet?