# Using input-file-plugin, just work after modifying the file, and logstash is not closing after indexing

**URL:** <https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130>\
**Category:** Logstash\
**Created:** [July 24, 2019, 8:08pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130 "2019-07-24T20:08:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Romulo\_Ramos\_de\_Siqu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romulo_ramos_de_siqu/32/47247_2.png) [@Romulo\_Ramos\_de\_Siqu](https://discuss.elastic.co/u/Romulo_Ramos_de_Siqu)\
**Post date:** [July 24, 2019, 8:08pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/1 "2019-07-24T20:08:13Z")

</div>

I'm trying to use logstash to upload a json with arrays to elasticsearch, but when I run the logstash with the specified .conf file, it successfully start at port 9200, and then... nothing. It only works after I get to .json file and modify it somehow.

**My .conf file**

'input {

```
	file {
	type => "_doc"
	path => ["/home/romulo/data.json"]
	start_position => "beginning"
	codec => json
	
	}	
}

filter {
	
	json { source => "message" }

}

output {	
	
	elasticsearch {
   		action => "index"
    	index => "teste"
   		document_id => "%{id}"
   		hosts => "localhost:9200"
   	}

	stdout { 
		codec => rubydebug 
	}
}`
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 8:23pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/2 "2019-07-24T20:23:25Z")

</div>

The [file](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) input, by default, will tail a file looking for new data to be appended to it. The documentation cover tail vs. read mode and how it persists state in the sincedb.

It is possible that adding 'sincedbpath =\> "/dev/null"' will fix your issue.

---

<div class="post-metadata">

**Author:** ![Romulo\_Ramos\_de\_Siqu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romulo_ramos_de_siqu/32/47247_2.png) [@Romulo\_Ramos\_de\_Siqu](https://discuss.elastic.co/u/Romulo_Ramos_de_Siqu)\
**Post date:** [July 24, 2019, 8:24pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/3 "2019-07-24T20:24:24Z")

</div>

Thanks for the answer, I'll try

---

<div class="post-metadata">

**Author:** ![Romulo\_Ramos\_de\_Siqu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romulo_ramos_de_siqu/32/47247_2.png) [@Romulo\_Ramos\_de\_Siqu](https://discuss.elastic.co/u/Romulo_Ramos_de_Siqu)\
**Post date:** [July 24, 2019, 8:33pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/4 "2019-07-24T20:33:34Z")

</div>

Now it's working, but after indexing, logstash is not shutting down

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 8:45pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/5 "2019-07-24T20:45:57Z")

</div>

> [@Romulo\_Ramos\_de\_Siqu](#):
>
> after indexing, logstash is not shutting down

Correct. It will wait forever to see if more data is appended to the file.

---

<div class="post-metadata">

**Author:** ![Romulo\_Ramos\_de\_Siqu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romulo_ramos_de_siqu/32/47247_2.png) [@Romulo\_Ramos\_de\_Siqu](https://discuss.elastic.co/u/Romulo_Ramos_de_Siqu)\
**Post date:** [July 24, 2019, 8:57pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/6 "2019-07-24T20:57:29Z")

</div>

There's someway to shut logstash down after indexing the first time? Or it's not a common use of logstash?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 10:04pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/7 "2019-07-24T22:04:25Z")

</div>

If you can use a stdin input instead of a file input then it would shut logstash down when it reaches end-of-file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2019, 10:04pm UTC](https://discuss.elastic.co/t/using-input-file-plugin-just-work-after-modifying-the-file-and-logstash-is-not-closing-after-indexing/192130/8 "2019-08-21T22:04:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.