# Unable to parse a simple log file using logstash

**URL:** <https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582>\
**Category:** Logstash\
**Created:** [April 17, 2017, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582 "2017-04-17T13:44:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ItsMeSurajR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsmesurajr/32/17395_2.png) [@ItsMeSurajR](https://discuss.elastic.co/u/ItsMeSurajR)\
**Post date:** [April 17, 2017, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582/1 "2017-04-17T13:44:34Z")

</div>

I'm a beginner and I could able to parse a log file successfully before. But all after a sudden, even a simple conf isn't working. Can anyone tell me what's wrong here? There are no errors, everything looks ok for me but no success.

Pls help ☹

```
root@ubuntu:/etc/logstash/conf.d# cat test.conf 
input {
	file {
		path => "/home/surajr/Documents/input1.log"
	}
}

output {
	file {
		path => "/home/surajr/Documents/output1.txt"
	}
}
root@ubuntu:/etc/logstash/conf.d# sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/test.conf 
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties

surajr@ubuntu:/usr/share/logstash/logs$ tail -f logstash-plain.log 
[2017-04-17T03:53:52,596][WARN][logstash.runner] SIGINT received. Shutting down the agent.
[2017-04-17T03:53:52,604][WARN][logstash.agent] stopping pipeline {:id=>"main"}
[2017-04-17T03:56:21,118][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-04-17T03:56:21,451][INFO][logstash.pipeline] Pipeline main started
[2017-04-17T03:56:21,549][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2017-04-17T03:57:50,328][WARN][logstash.runner] SIGINT received. Shutting down the agent.
[2017-04-17T03:57:50,372][WARN][logstash.agent] stopping pipeline {:id=>"main"}
[2017-04-17T06:05:19,777][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-04-17T06:05:20,097][INFO][logstash.pipeline] Pipeline main started
[2017-04-17T06:05:20,352][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
```

---

<div class="post-metadata">

**Author:** ![luciferdude](https://avatars.discourse-cdn.com/v4/letter/l/f19dbf/32.png) [@luciferdude](https://discuss.elastic.co/u/luciferdude)\
**Post date:** [April 17, 2017, 3:12pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582/2 "2017-04-17T15:12:21Z")

</div>

Check if logstash has permission to read from input and write to output. do a 755 on both files and restart to see if it works.

---

<div class="post-metadata">

**Author:** ![ItsMeSurajR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsmesurajr/32/17395_2.png) [@ItsMeSurajR](https://discuss.elastic.co/u/ItsMeSurajR)\
**Post date:** [April 18, 2017, 10:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582/3 "2017-04-18T22:03:24Z")

</div>

I resolved my issue. Unless I touch the file, it's not being triggered by the logstash server.

---

<div class="post-metadata">

**Author:** ![luciferdude](https://avatars.discourse-cdn.com/v4/letter/l/f19dbf/32.png) [@luciferdude](https://discuss.elastic.co/u/luciferdude)\
**Post date:** [April 18, 2017, 10:10pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582/4 "2017-04-18T22:10:46Z")

</div>

Yes, i believe that's because of the sinceDB. This keeps track of the last line that was read from logstash. The first time it starts up, read the entire file. subsequent start ups on the same file shows only the newly added .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2017, 10:11pm UTC](https://discuss.elastic.co/t/unable-to-parse-a-simple-log-file-using-logstash/82582/5 "2017-05-16T22:11:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.