Why always need to run first logstash conf file then put log file on specific folder

Elastic Stack Logstash
1

Hi,
i am running logstash through pragmatically when first i putted file on specific folder then started running longstash file through command . then need to open that log file from specific folder do some operation and saved it , so logstash started running fine.

Can have alternate way to execute logstash file on log file which is already present in folder.

2

This is probably related to sincedb. Logstash thinks it has already processed a file, but when you open it and save it it gets a new inode number and therefore Logstash discovers it as a new file. The file input documentation explains this in greater detail and if you crank up Logstash's log level you get additional clues about what it's doing.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.