# Windows 10 File input hangs \[SOLVED\]

**URL:** https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462
**Category:** Logstash
**Created:** [October 1, 2015, 9:56am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462 "2015-10-01T09:56:30Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)
#### Post date: [October 1, 2015, 9:56am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/1 "2015-10-01T09:56:30Z")

</div>

Running in virtual test environment on Windows 10. Looked at all sorts of topics on this only to find all solutions (often just how to type the file path) are coming up unsuccessful. Behavior is Logstash hangs on "Logstash startup complete" and fails to read files. Stdin test does just fine. Tested with wildcards and without, and made sure Logstash ran on even admin permissions to read/write files/directories.

Current config:

```
input {
	file {
		path => ["C:/ELK/LogSamples/00605828/clientA.log"]
		sincedb_path => "C:/ELK/logstash-1.5.4/sincedb"
		codec => multiline {
			pattern => "^\s"
			what => "previous"
		}
	}
}

#filter {
#	grok {
# match => { "message" => "%{LOGLEVEL:loglevel}: %{MONTHNUM2:month}/%{MONTHNUM2:day} %{TIME:timestamp}(?:\s\d\d|\s\s\d)\s%{DATA:event}" }
# }
#	}

output {
	elasticsearch {
		}
	file {
		path => "c:/elk/logstashtest.txt"
		}
}

```

Output is as follows:

```
C:\ELK\logstash-1.5.4\bin>logstash -f C:\ELK\logstash-1.5.4\logstash.conf
io/console not supported; tty will not be manipulated
Oct 01, 2015 2:48:17 AM org.elasticsearch.node.internal.InternalNode <init>
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] version[1.7.0], pid[2804], build[929b973/2015-07-16T14:31:07Z]
Oct 01, 2015 2:48:17 AM org.elasticsearch.node.internal.InternalNode <init>
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] initializing ...
Oct 01, 2015 2:48:17 AM org.elasticsearch.plugins.PluginsService <init>
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] loaded [], sites []
Oct 01, 2015 2:48:19 AM org.elasticsearch.bootstrap.Natives <clinit>
WARNING: JNA not found. native methods will be disabled.
Oct 01, 2015 2:48:20 AM org.elasticsearch.node.internal.InternalNode <init>
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] initialized
Oct 01, 2015 2:48:20 AM org.elasticsearch.node.internal.InternalNode start
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] starting ...
Oct 01, 2015 2:48:20 AM org.elasticsearch.transport.TransportService doStart
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] bound_address {inet[/0:0:0:0:0:0:0:0:9301]}, publish_address {inet[/10.0.2.15:9301]}
Oct 01, 2015 2:48:20 AM org.elasticsearch.discovery.DiscoveryService doStart
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] elasticsearch/X6Vjq2FcSNKIhmiPNvFU5w
Oct 01, 2015 2:48:23 AM org.elasticsearch.cluster.service.InternalClusterService$UpdateTask run
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] detected_master [Yukon Jack][FNrfZ1S4TvOFTV7d83L2fA][DESKTOP-2QF2QGE][inet[/10.0.2.15:9300]], added {[Yukon Jack][FNrfZ1S4TvOFTV7d83L2fA][DESKTOP-2QF2QGE][inet[/10.0.2.15:9300]],}, reason: zen-disco-receive(from master [[Yukon Jack][FNrfZ1S4TvOFTV7d83L2fA][DESKTOP-2QF2QGE][inet[/10.0.2.15:9300]]])
Oct 01, 2015 2:48:23 AM org.elasticsearch.node.internal.InternalNode start
INFO: [logstash-DESKTOP-2QF2QGE-2804-13462] started
Logstash startup completed

```

Preemptive thanks on my part!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 1, 2015, 9:58am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/2 "2015-10-01T09:58:42Z")

</div>

Has new data been appended to C:/ELK/LogSamples/00605828/clientA.log since you started Logstash?

---

<div class="post-metadata">

### Author: ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)
#### Post date: [October 1, 2015, 12:00pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/3 "2015-10-01T12:00:22Z")

</div>

Hi Magnus, thank you for the help.

It's seen no changes, but I have no sourcedb or any related files present that I know of that would show Logstash keeping a record of looking at that file. The one I assigned in the sourcedb\_path is not being created.

I have also changed the path to direct to other files that Logstash has not seen in order to test this, to no success.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 1, 2015, 12:07pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/4 "2015-10-01T12:07:06Z")

</div>

By default Logstash's file input tails files and does _not_ read them from the beginning. If you want something else you'll have to look into the [`start_position` parameter](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-start_position).

---

<div class="post-metadata">

### Author: ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)
#### Post date: [October 1, 2015, 12:30pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/5 "2015-10-01T12:30:41Z")

</div>

That is my intended design, but no matter what I push to Logstash, even brand new files, the file input plugin does not want to touch them.

I did test with start\_position =\> beginning but no change in behavior.

Through my research on this I discovered there are some issues with how the file plugin works that does not like Windows, but I'm not sure what alternatives to use to read such text files. Even so, some people do seem to have no problems on Windows with the file plugin.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 1, 2015, 1:35pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/6 "2015-10-01T13:35:01Z")

</div>

Cranking up Logstash's log level with `--verbose` or `--debug` may reveal interesting information.

---

<div class="post-metadata">

### Author: ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)
#### Post date: [October 1, 2015, 3:40pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/7 "2015-10-01T15:40:21Z")

</div>

As I thought, it is stuck trying to discover the file:

```
e[36m_discover_file_glob: C:/ELK/LogSamples/00605828/clientA.log: glob is: ["C:/ELK/LogSamples/00605828/clientA.log"] {:level=>:debug, :file=>"/ELK/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/filewatch-0.6.5/lib/filewatch/watch.rb", :line=>"132", :method=>"_discover_file"}e[0m

```

It keeps repeating that event.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 1, 2015, 6:18pm UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/8 "2015-10-01T18:18:42Z")

</div>

Well, that's what it's supposed to be doing every ten seconds. The question is, why isn't it proceeding and trying to open and read the file? Is the periodic discover\_file\_glob all you get even with `--debug`?

---

<div class="post-metadata">

### Author: ![IGarvin](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@IGarvin](https://discuss.elastic.co/u/IGarvin)
#### Post date: [October 2, 2015, 9:22am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/9 "2015-10-02T09:22:30Z")

</div>

Found the problem, debug output showed me that it was in fact reading a sincedb file. Then it dawned on me: silly me, I forgot to turn on show hidden files in the test environment! Deleting it did trigger it to read properly. Thank you for your patience in helping me with this!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462/10 "2017-07-06T05:27:28Z")

</div>