Using logstash File Input to monitor files on a network share

Elastic Stack Logstash
1

Hi,
we are using Logstash on Windows to process logfiles residing on several windows servers. Is it possible / advisible to setup network shares to the various logfiles from the shipper machine and ship all log files from one central shipper machine or is it better to deploy shipper instances locally on the servers whose logs are being processed?

Any experiences / idea / input welcome.

Bye,
Markus

2

Reading files from network shares is OK with Logstash's file input. :slight_smile:

One thing to be aware of: Some network filesystems (nfs) have aggressive client-side caching that cause Logstash to be lied to about the state of the file - this caching prevents Logstash from detecting new changes in files on those nfs mounts.

For windows, Samba/CIFS I think, I can't recall anyone having trouble with this, so it should work fine. Of course, let us know if you find otherwise :smile:

2 Likes
3

I have an issue with logstash running on windows server 2012:
Logstash reads log files from network shared folders. On startup everything seems OK, but then logstash stops reading. When I restart logstash it reads the latest entries and then stops again.

How can I check if this is a logstash issue or if this is due to windows file caching ? Is there any workaround ?