logstash file input configuration

Question

My simple config looks like this. I have created a dummy folder in my home directory and created some log files in it. My config file looks like this.

input{
    file{
        type => "dummylog"
        path => [/home/rohit/dummy/*.log" ]
    }
}
output{
    elasticsearch{
        embedded => true
    }
}

Now after running logstash i am unable to see in any files in web ui of logstash. Those files have not fetched into elasticsearch. I am using an embedded elasticsearch so no need to run a separate process. Can anyone help me where i am committing mistake?

mightyteja · Accepted Answer · 2014-08-02 11:36:31Z

6

input {
  file {
    path => "/home/rohit/dummy/*.log"
    type => "log"
  }
}

filter {
  if [type] == "log" {
    grok {
      pattern => "%{COMBINEDAPACHELOG}"
    }
  }
}

output {
   elasticsearch { host => localhost } stdout { } }
}

to check for the pattern if correct run

$ bin/logstash agent -f httpd-shipper.conf --configtest

answered Aug 2, 2014 at 11:36

mightyteja

9232 gold badges14 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Adam · Accepted Answer · 2013-05-17 12:33:17Z

3

Perhaps you should fix the syntax errors in your config and then see if there is a deeper problem.

You are missing a " in the line:

    path => [/home/rohit/dummy/*.log" ]

If that doesn't solve the problem, it would be wise to confirm that the user that runs the logstash process, has read access to the log(s) it is trying to read.

answered May 17, 2013 at 12:33

Adam

1,9822 gold badges17 silver badges30 bronze badges

Comments

Harichandan Pulagam · Accepted Answer · 2017-03-09 01:53:38Z

2

Be very careful of the syntax. You missed "(quotes) in the path

input{
    file{
        type => "dummylog"
        path => ["/home/rohit/dummy/*.log"]
    }
}

output{
    elasticsearch{
        embedded => true
    }
}

Also note that for this to work, elasticsearch has to be on the same host as logstash.

edited Mar 9, 2017 at 1:53

Harichandan Pulagam

3684 silver badges17 bronze badges

answered Jul 2, 2013 at 5:15

Aakash Anuj

3,8698 gold badges37 silver badges48 bronze badges

Comments

gek · Accepted Answer · 2015-03-17 15:14:55Z

1

In addition to the opening quotation mark you must have forgotten about:

start_position => ... # string, one of ["beginning", "end"] (optional), default: "end"

So, it should be:

input{
  file{
    type => "dummylog"
    path => "/home/rohit/dummy/*.log"
    start_position => "beginning"
  }
}
  output {
     elasticsearch{
      embedded => true
  }
}

answered Mar 17, 2015 at 15:14

gek

5548 silver badges18 bronze badges

Collectives™ on Stack Overflow

logstash file input configuration

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related