elasticsearch - Logstash File Input not outputting event after file change -
i trying read file , output each events console (or file). want able add file , have picked logstash , repeat pipeline. however, logstash seems read , perform pipeline once though sees file has changed.
i developing on os x yosemite.
here's logstash config
input { file { path => "/users/justin/logstash-1.5.2/testfile" sincedb_path => "/users/justin/logstash-1.5.2/.sincedb" start_position => "beginning" } } output { stdout { } }
here's log (also, tried sudo, no luck):
justins-macbook-pro-2:logstash-1.5.2 justin$ bin/logstash agent --debug -vf myconfig reading config file {:file=>"logstash/agent.rb", :level=>:debug, :line=>"295", :method=>"local_config"} compiled pipeline code: @inputs = [] @filters = [] @outputs = [] @periodic_flushers = [] @shutdown_flushers = [] @input_file_1 = plugin("input", "file", logstash::util.hash_merge_many({ "path" => ("/users/justin/logstash-1.5.2/testfile") }, { "sincedb_path" => ("/users/justin/logstash-1.5.2/.sincedb") }, { "start_position" => ("beginning") })) @inputs << @input_file_1 @output_stdout_2 = plugin("output", "stdout") @outputs << @output_stdout_2 def filter_func(event) events = [event] @logger.debug? && @logger.debug("filter received", :event => event.to_hash) events end def output_func(event) @logger.debug? && @logger.debug("output received", :event => event.to_hash) @output_stdout_2.handle(event) end {:level=>:debug, :file=>"logstash/pipeline.rb", :line=>"28", :method=>"initialize"} plugin not defined in namespace, checking plugin file {:type=>"input", :name=>"file", :path=>"logstash/inputs/file", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"133", :method=>"lookup"} plugin not defined in namespace, checking plugin file {:type=>"codec", :name=>"plain", :path=>"logstash/codecs/plain", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"133", :method=>"lookup"} config logstash::codecs::plain/@charset = "utf-8" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@path = ["/users/justin/logstash-1.5.2/testfile"] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@sincedb_path = "/users/justin/logstash-1.5.2/.sincedb" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@start_position = "beginning" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@debug = false {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@codec = <logstash::codecs::plain charset=>"utf-8"> {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@add_field = {} {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@stat_interval = 1 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@discover_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@sincedb_write_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::inputs::file/@delimiter = "\n" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} plugin not defined in namespace, checking plugin file {:type=>"output", :name=>"stdout", :path=>"logstash/outputs/stdout", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"133", :method=>"lookup"} plugin not defined in namespace, checking plugin file {:type=>"codec", :name=>"line", :path=>"logstash/codecs/line", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"133", :method=>"lookup"} config logstash::codecs::line/@charset = "utf-8" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::outputs::stdout/@type = "" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::outputs::stdout/@tags = [] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::outputs::stdout/@exclude_tags = [] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::outputs::stdout/@codec = <logstash::codecs::line charset=>"utf-8"> {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} config logstash::outputs::stdout/@workers = 1 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"112", :method=>"config_init"} registering file input {:path=>["/users/justin/logstash-1.5.2/testfile"], :level=>:info, :file=>"logstash/inputs/file.rb", :line=>"76", :method=>"register"} pipeline started {:level=>:info, :file=>"logstash/pipeline.rb", :line=>"86", :method=>"run"} logstash startup completed _sincedb_open: reading /users/justin/logstash-1.5.2/.sincedb {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"220", :method=>"_sincedb_open"} _sincedb_open: setting ["11809694", 1, 4] 1089 {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"224", :method=>"_sincedb_open"} _sincedb_open: setting ["11850406", 1, 4] 15 {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"224", :method=>"_sincedb_open"} _discover_file_glob: /users/justin/logstash-1.5.2/testfile: glob is: ["/users/justin/logstash-1.5.2/testfile"] {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"132", :method=>"_discover_file"} _discover_file: /users/justin/logstash-1.5.2/testfile: new: /users/justin/logstash-1.5.2/testfile (exclude []) {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"141", :method=>"_discover_file"} _open_file: /users/justin/logstash-1.5.2/testfile: opening {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"119", :method=>"_open_file"} /users/justin/logstash-1.5.2/testfile: initial create, no sincedb, seeking beginning of file {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"156", :method=>"_open_file"} received line {:path=>"/users/justin/logstash-1.5.2/testfile", :text=>"hello world", :level=>:debug, :file=>"logstash/inputs/file.rb", :line=>"137", :method=>"run"} received line {:path=>"/users/justin/logstash-1.5.2/testfile", :text=>"testing", :level=>:debug, :file=>"logstash/inputs/file.rb", :line=>"137", :method=>"run"} output received {:event=>{"message"=>"hello world", "@version"=>"1", "@timestamp"=>"2015-07-21t22:58:13.460z", "host"=>"justins-macbook-pro-2.local", "path"=>"/users/justin/logstash-1.5.2/testfile"}, :level=>:debug, :file=>"(eval)", :line=>"21", :method=>"output_func"} writing sincedb (delta since last write = 1437519493) {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"196", :method=>"_read_file"}2015-07-21t22:58:13.460z justins-macbook-pro-2.local hello world output received {:event=>{"message"=>"testing", "@version"=>"1", "@timestamp"=>"2015-07-21t22:58:13.464z", "host"=>"justins-macbook-pro-2.local", "path"=>"/users/justin/logstash-1.5.2/testfile"}, :level=>:debug, :file=>"(eval)", :line=>"21", :method=>"output_func"} 2015-07-21t22:58:13.464z justins-macbook-pro-2.local testing /users/justin/logstash-1.5.2/testfile: file grew, old size 0, new size 20 {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"96", :method=>"each"} _discover_file_glob: /users/justin/logstash-1.5.2/testfile: glob is: ["/users/justin/logstash-1.5.2/testfile"] {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"132", :method=>"_discover_file"}
after change file (in case, testfile) shows nothing else:
/users/justin/logstash-1.5.2/testfile: file grew, old size 20, new size 29 {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"96", :method=>"each"} _discover_file_glob: /users/justin/logstash-1.5.2/testfile: glob is: ["/users/justin/logstash-1.5.2/testfile"] {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"132", :method=>"_discover_file"}
also, doesn't seem crashing or anything. sees file has changed doesn't run function output.
there option in logstash config file .
input { file { discover_interval => ... # number (optional), default: 15 stat_interval => ... # number (optional), default: 1 sincedb_path => ... # string (optional) sincedb_write_interval => ... # number (optional), default: 15 } }
here discover_interval * stat_interval = seconds
wait 15 seconds . if still facing same problem delete .sincedb_* files. , restart logstash service. sincedb store details processed files. hope work.
Comments
Post a Comment