Unable to re-process the log file using logstash version 2.3.2

0
votes

I have processed a file using logstash and pushed it to elasticsearch it work. However, I had to make some changes to the logstash conf file and need to process the log file again. I deleted the index on es and restarted the logstash. I dont see the data in elasticsearch, it looks like the file is not being processed.

1. I am using logstash version 2.3.2
2. I deleted _sincedb file, restarted logstash, no log
3. I checked the conf file syntax via --configcheck and it is ok.

Any ideas what I am missing here?

I dont see any index created, no data in es. I tried these steps multiple times.

1
elasticsearchlogstash

1 Answers

1
votes

Logstash is smart enough to remember until which line it has already processed each file you've given him and stores that cursor in a sincedb file.

So, in addition to the path setting, you need to specify two more parameters in your file input that will make sure that the file is re-processed on each run:

file {
    path => "/path/to/file"
    start_position => "beginning"
    sincedb_path => "/dev/null"
}