# Unable to Read from File in Windows

**URL:** https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784
**Category:** Logstash
**Created:** [June 16, 2015, 8:11pm UTC](https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784 "2015-06-16T20:11:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JamesRenaud](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@JamesRenaud](https://discuss.elastic.co/u/JamesRenaud)
#### Post date: [June 16, 2015, 8:11pm UTC](https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784/1 "2015-06-16T20:11:26Z")

</div>

Hey all,

I'm at a bit of a loss on this one after spending a couple hours on Google and checking through about a dozen articles I'm still not getting this resolved.

I have a flat \*.log file that I'm trying to read from, my config file is:

* * *

input  
{  
stdin  
{

```
}
file
{
	path => "C:/Program Files (x86)/Mitel/MiContact Center/Logs/MaintenanceAlarmDispatcher.log"
	start_position => "beginning"
}

```

}  
filter  
{  
grok  
{  
match =\> ["message", "%{LOGLEVEL:level}:%{SPACE}(?\d{4}-\w{3}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})%{SPACE}%{GREEDYDATA:log\_line}"]  
tag\_on\_failure =\> ['']  
}  
date  
{  
match =\> ["timestamp", "YYYY-MMM-dd HH:mm:ss.SSS"]  
}  
}  
output  
{  
elasticsearch  
{  
host =\> localhost  
port =\> 9301  
}  
stdout  
{

```
}

```

}

* * *

Now, if I paste in a log line manually through the console it comes through into elastic ok - so I know my grok matching is good, which means something is wrong with the file input.

Any ideas on where to go from here?

---

<div class="post-metadata">

### Author: ![chaitanyavvs](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@chaitanyavvs](https://discuss.elastic.co/u/chaitanyavvs)
#### Post date: [June 16, 2015, 8:19pm UTC](https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784/2 "2015-06-16T20:19:33Z")

</div>

Hi James,  
If the log file is a static file (old log file) , then the configuration `start_position => "beginning"` to the `file` input plugin. The `file` input plugin reads only from the end of the file, adding the above config would read from start.

The only drawback i noticed is that, if the log is live log (as data gets appended to the log), adding the config (after deleting the `.sincedb` file) will re-scan the entire log file from beginning.

Thanks and Regards,  
Chaitanya Varanasi

---

<div class="post-metadata">

### Author: ![JamesRenaud](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@JamesRenaud](https://discuss.elastic.co/u/JamesRenaud)
#### Post date: [June 16, 2015, 8:27pm UTC](https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784/3 "2015-06-16T20:27:01Z")

</div>

Looks like I had some .sincedb files created before my GROK was solid, deleted those and now I've got it parsing the file nicely.

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/unable-to-read-from-file-in-windows/23784/4 "2017-07-06T05:37:18Z")

</div>