Unable to parse a simple log file using logstash

Elastic Stack Logstash
1

I'm a beginner and I could able to parse a log file successfully before. But all after a sudden, even a simple conf isn't working. Can anyone tell me what's wrong here? There are no errors, everything looks ok for me but no success.

Pls help :frowning:

root@ubuntu:/etc/logstash/conf.d# cat test.conf 
input {
	file {
		path => "/home/surajr/Documents/input1.log"
	}
}

output {
	file {
		path => "/home/surajr/Documents/output1.txt"
	}
}
root@ubuntu:/etc/logstash/conf.d# sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/test.conf 
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties



surajr@ubuntu:/usr/share/logstash/logs$ tail -f logstash-plain.log 
[2017-04-17T03:53:52,596][WARN ][logstash.runner          ] SIGINT received. Shutting down the agent.
[2017-04-17T03:53:52,604][WARN ][logstash.agent           ] stopping pipeline {:id=>"main"}
[2017-04-17T03:56:21,118][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-04-17T03:56:21,451][INFO ][logstash.pipeline        ] Pipeline main started
[2017-04-17T03:56:21,549][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2017-04-17T03:57:50,328][WARN ][logstash.runner          ] SIGINT received. Shutting down the agent.
[2017-04-17T03:57:50,372][WARN ][logstash.agent           ] stopping pipeline {:id=>"main"}
[2017-04-17T06:05:19,777][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-04-17T06:05:20,097][INFO ][logstash.pipeline        ] Pipeline main started
[2017-04-17T06:05:20,352][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
2

Check if logstash has permission to read from input and write to output. do a 755 on both files and restart to see if it works.

3

I resolved my issue. Unless I touch the file, it's not being triggered by the logstash server.

4

Yes, i believe that's because of the sinceDB. This keeps track of the last line that was read from logstash. The first time it starts up, read the entire file. subsequent start ups on the same file shows only the newly added .

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.