Logstash is not reading all the logs
2017-01-09 10:04
260 查看
https://discuss.elastic.co/t/logstash-is-not-reading-all-the-logs/61302
I want my logstash to read the following pattern of files from the logs directory
Current Date File -> server.log
Historical File Name -> server.log.yyyy-mm-dd
In my system I have 22 files in my logs folder
server.log
server.log.2016-09-22
server.log.2016-09-21
server.log.2016-09-20
server.log.2016-09-19
server.log.2016-09-18
server.log.2016-09-17
and so on in this way everyday files are renamed with date appended to name and current date file is named as server.log
my conf file is as follows
input {
file {
type => "serverlog"
path => ["E:/Code_Athon/test/test1/*server.log*"]
start_position => "beginning"
}
}
I also tried the below configurations
input {
file {
type => "serverlog"
path => ["E:/test/test1/server.log","E:/test/test1/server.log*"]
start_position => "beginning"
}
}
In the above configuration i observed that logstash picked up server.log and server.log.2016-09-21 and it does not go to other
files in past , may be because of performance issues or worker thread , but I did not get any error on console.
input {
file {
type => "serverlog"
path => ["E:/test/test1/server.log","E:/test/test1/server.log*"]
path => ["E:/test/test1/server.log.--*"]
start_position => "beginning"
}
}
Can anyone suggest what should be my configuration so that my lohgstash can read the current file , past file and daily rollover file
named as server.log
Am i missing any configurations here ?
================================================================================
You may need to change the ignore_older8 setting
for the file input plugin in order to make Logstash process older files.
I want my logstash to read the following pattern of files from the logs directory
Current Date File -> server.log
Historical File Name -> server.log.yyyy-mm-dd
In my system I have 22 files in my logs folder
server.log
server.log.2016-09-22
server.log.2016-09-21
server.log.2016-09-20
server.log.2016-09-19
server.log.2016-09-18
server.log.2016-09-17
and so on in this way everyday files are renamed with date appended to name and current date file is named as server.log
my conf file is as follows
input {
file {
type => "serverlog"
path => ["E:/Code_Athon/test/test1/*server.log*"]
start_position => "beginning"
}
}
I found the above configuration does not work for me and is reading only server.log file. No past files
I also tried the below configurations
input {
file {
type => "serverlog"
path => ["E:/test/test1/server.log","E:/test/test1/server.log*"]
start_position => "beginning"
}
}
In the above configuration i observed that logstash picked up server.log and server.log.2016-09-21 and it does not go to other
files in past , may be because of performance issues or worker thread , but I did not get any error on console.
input {
file {
type => "serverlog"
path => ["E:/test/test1/server.log","E:/test/test1/server.log*"]
path => ["E:/test/test1/server.log.--*"]
start_position => "beginning"
}
}
Even this configuration does not solve my issue.
Can anyone suggest what should be my configuration so that my lohgstash can read the current file , past file and daily rollover file
named as server.log
Am i missing any configurations here ?
================================================================================
You may need to change the ignore_older8 setting
for the file input plugin in order to make Logstash process older files.
相关文章推荐
- adstpall.sh: Database connection could not be established. Either the database is down or the APPS c
- Logstash could not be started because there is already another instance using the configured data di
- 解决问题:The directory '/Users/Parthenon/Library/Logs/pi' or its parent directory is not owned by the
- 【.net】The source was not found, but some or all event logs could not be searched
- [解决] User [dr.who] is not authorized to view the logs for application
- 提交appstore遇到的问题 ITMS-90239:”Invalid Signature.Code object is not signed at all.The binary at path
- MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk. Commands that may modify the data set are disabled. Please check Redis logs for details about the error
- MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk. Commands that may modify the data set are disabled. Please check Redis logs for details about the error
- #Redis Error #MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk. Commands that may modify the data set are disabled. Please check Redis logs for details a
- System.Security.SecurityException The source was not found, but some or all event logs could not be searched.Inaccessible logs Security.
- version 1.7.0_17 of the JVM is not suitable for this product , Version 1.8 or greater i s required
- 访问嵌入式网页出错:The requested URL '/' resolves to a file which is marked executable but is not a CGI file
- 启动VMware出现报错:The VMware Authorization Service is not running
- tomcat启动一闪而过解决办法报错The CATALINA_HOME environment variable is not defined correctly
- is not in the sudoers file
- MavenReportException:The environment variable JAVA_HOME is not correctly set.错误异常解决方法
- cluvfy - CRS is not installed on any of the nodes
- When the layout is set to FIXED LAYOUT, the VERTICAL ALIGNMENT is not working. As soon as changed to
- 【ASP.NET Core】解决“The required antiforgery cookie "xxx" is not present”的错误
- 解决办法:Access restriction: The type JPEGImageEncoder is not accessible due to restriction