Code Monkey home page Code Monkey logo

logstash-input-file's Introduction

Logstash Plugin

Travis Build Travis Build Status

This is a plugin for Logstash.

It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.

Documentation

Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one central location.

Need Help?

Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.

Developing

1. Plugin Developement and Testing

Code

  • To get started, you'll need JRuby with the Bundler gem installed.

  • Create a new plugin or clone and existing from the GitHub logstash-plugins organization. We also provide example plugins.

  • Install dependencies

bundle install

Test

  • Update your dependencies
bundle install
  • Build the jar library used for watching files
./gradlew build
  • Run tests
bundle exec rspec

2. Running your unpublished Plugin in Logstash

2.1 Run in a local Logstash clone

  • Edit Logstash Gemfile and add the local plugin path, for example:
gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
  • Install plugin
# Logstash 2.3 and higher
bin/logstash-plugin install --no-verify

# Prior to Logstash 2.3
bin/plugin install --no-verify
  • Run Logstash with your plugin
bin/logstash -e 'filter {awesome {}}'

At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.

2.2 Run in an installed Logstash

You can use the same 2.1 method to run your plugin in an installed Logstash by editing its Gemfile and pointing the :path to your local plugin development directory or you can build the gem and install it using:

  • Build your plugin gem
gem build logstash-filter-awesome.gemspec
  • Install the plugin from the Logstash home
# Logstash 2.3 and higher
bin/logstash-plugin install --no-verify

# Prior to Logstash 2.3
bin/plugin install --no-verify
  • Start Logstash and proceed to test the plugin

Contributing

All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.

Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.

It is more important to the community that you are able to contribute.

For more information about contributing, see the CONTRIBUTING file.

logstash-input-file's People

Contributors

andsel avatar bigyellowhammer avatar colinsurprenant avatar ddaanet avatar dedemorton avatar edmocosta avatar electrical avatar fishie avatar glenrsmith avatar gmoskovicz avatar guyboertje avatar jakelandis avatar jimmyjones2 avatar joe-insitro avatar jordansissel avatar jsvd avatar karenzone avatar kares avatar kristoffeys avatar magnusbaeck avatar ph avatar robbavey avatar shredder12 avatar suyograo avatar talevy avatar thbay avatar untergeek avatar wiibaa avatar yaauie avatar ycombinator avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

logstash-input-file's Issues

file input delimiter setting does not allow escape characters

The delimiter setting in the file input plugin doesn't work as expected, presumably due to elastic/logstash#1645 , which causes Logstash to interpret "\r" as unescaped characters: "","r".

This means that if my line endings are \r (Logstash expects \n by default), I cannot use the delimiter setting to override it.

Is there a workaround for this?

Windows: New files aren't correctly read

When the plugin is watching files, it doesn't read the last event until a new event comes in.

input { file { path => "c:/new-logs/*.log" start_position => "beginning"  } } output { stdout { codec => rubydebug }}

Log: testing.log

TEST1
TEST2
TEST3
TEST4

Start logstash, add "TEST5" and "TEST6" at the end of the file, Save you only get "TEST5"

NotImplementedError: block device detection unsupported or native support failed to load

(This issue was originally filed by @widyanto at elastic/logstash#3146)


Hi,

I am trying to run logstash 1.5.0 RC3 on IBM AIX and got the following error:

<somefolder>/logstash-1.5.0-rc3> bin/logstash agent -f jda-phoenix-forwarder.conf
io/console not supported; tty will not be manipulated
NotImplementedError: block device detection unsupported or native support failed to load
       blockdev? at org/jruby/RubyFileTest.java:67
         device? at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/helper.rb:67
  _sincedb_write at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/tail.rb:230
   sincedb_write at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/filewatch-0.6.2/lib/filewatch/tail.rb:203
        teardown at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.9/lib/logstash/inputs/file.rb:151
     inputworker at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0.rc3-java/lib/logstash/pipeline.rb:203
     synchronize at org/jruby/ext/thread/Mutex.java:149
     inputworker at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0.rc3-java/lib/logstash/pipeline.rb:203
     start_input at <somefolder>/logstash-1.5.0-rc3/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0.rc3-java/lib/logstash/pipeline.rb:171

I only have file input. Can anybody help?

Thanks

constant "A plugin had an unrecoverable error"

I'm running logstash 1.5.0.rc2 with the following config:

input {
    file {
        path => "/var/log/syslog-ng/uberlog/uberlog.log"
        codec => json
    }
}

output {
    file {
        path => "/var/log/logstash/%{type}/%{channel}/%{channel}.log"
        message_format => "%{extra_formatted}"
    }
}

My log lines look like this:

{"@timestamp":"2015-03-19T11:11:06.415585+03:00","@version":1,"host":"web540","message":"Cron DatingRateCron[{\"copy\":\"96\",\"server_id\":null,\"priority\":\"1\"}] used too much memory: 115605504","type":"topface","channel":"CronManager","level":"WARNING","extra_elapsed":144.54081296921,"extra_revision":"20150318040","extra_mode":"CLI","extra_formatted":"web540 r20150318040 2015-03-19 11:11:06,415 +144.541 CLIWARN  [pid:91812 controller:DatingRateCron] Cron DatingRateCron[{\"copy\":\"96\",\"server_id\":null,\"priority\":\"1\"}] used too much memory: 115605504","ctx_pid":91812,"ctx_controller":"DatingRateCron"}
{"@timestamp":"2015-03-19T11:11:06.485589+03:00","@version":1,"host":"web540","message":"Fixing not existed key for age , user 94358774","type":"topface","channel":"DatingReport","level":"WARNING","extra_elapsed":112.38282799721,"extra_revision":"20150318040","extra_mode":"CLI","extra_formatted":"web540 r20150318040 2015-03-19 11:11:06,485 +112.383 CLIWARN  [pid:92796 controller:DatingRateCron] Fixing not existed key for age , user 94358774","ctx_pid":92796,"ctx_controller":"DatingRateCron"}

After incorrect json line (I assume, not sure) logstash falls into the following state:

{:timestamp=>"2015-03-19T08:09:16.320000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:17.324000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:18.328000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:19.331000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:20.335000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:21.338000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:22.342000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:23.346000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:24.349000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:25.353000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:26.356000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}
{:timestamp=>"2015-03-19T08:09:27.360000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/var/log/syslog-ng/uberlog/uberlog.log\"], start_position=>\"end\", delimiter=>\"\\n\">\n  Error: string not matched", :level=>:error}

Incorrect lines happen because syslog-ng splits long lines into several. I'm going to fix this, but I think it should not lead to constant unrecoverable errors. If lines cannot be parsed with json coded, it should be skipped/passed with _jsonparsefailure tag as is. Incorrect lines are going to end at some point anyway.

Make file input work correctly with multiple files and codec

Right now multiline codec with path => "/some/path/*.log" will not work correctly becuase the same codec is shared across all files, which means merging is done incorrectly.

The symptom is that lines from different files become merged together, which is completely not expected or intended.

Multiple file input cause loosing data

(This issue was originally filed by @arnauldvm at elastic/logstash#2135)


I'm loosing lots of records when using a setup like this:

input { file {
  path => 'D:/some/path/access/*.log'
  sincedb_path => "target/.sincedb.xxxxxxxx.log"
  start_position => "beginning"
 (...)
} }
(...)
output { elasticsearch {
  host => localhost
  index => "logstash-xxxxxxxx-%{+YYYY.MM.dd}"
} }

Results:

index name actual (wc file.log) actually indexed in elasticsearch
logstash-xxxxxxxx-2014.11.17 27493 27493
logstash-xxxxxxxx-2014.11.18 18428 18308
logstash-xxxxxxxx-2014.11.19 18871 695
logstash-xxxxxxxx-2014.11.20 15517 15399
logstash-xxxxxxxx-2014.11.21 23700 7897
logstash-xxxxxxxx-2014.11.22 1442 1442
logstash-xxxxxxxx-2014.11.23 1440 1380
logstash-xxxxxxxx-2014.11.24 10570 9042
logstash-xxxxxxxx.failed-1970.01.01 - 2

Moreover some log lines are truncated, leading to parsing errors (cf. ...failed... index).

If I do:

$ cat /D/some/path/access/*.log > /D/some/path/all_access.log

and adapt the logstash config accordingly, nothing is lost.

On another hand, keeping the multiple files input, but outputting to a file instead of elasticsearch, also leads to no loss of data !?

Unable to delete old log files since logstash does not close active connections on them

(This issue was originally filed by @ramreddy26 at elastic/logstash#1922)


Hi,

Currently I am parsing only last 7 days of IIS, HTTP logs using logstash shipper(windows). I am trying to delete the log files which are older than 7 days but I am unable to delete the old log files while logstash service is running. Is there a way to close the active connections on old files without stopping the service? So that I could delete them.

document if file input support inotify

(This issue was originally filed by @bfx81 at elastic/logstash#2301)


On this old jira entry seems that file input plugin support inotify since version 1.0
https://logstash.jira.com/browse/LOGSTASH-39

But looking at the docs http://logstash.net/docs/1.4.2/inputs/file
it's not mentioned, and the following option really sounds like a polling source.

stat_interval
How often we stat files to see if they have been modified. Increasing this interval will decrease the number >of system calls we make, but increase the time to detect new log lines.

logstash file input: didn't collect update in 2 files on the same nfs mount point

(This issue was originally filed by @eshenskope at elastic/logstash#2132)


If I ask them to listen on each file, it can always detect the updates.

The input reading thread is doing.... does this mean its stuck somewhere?

"<file" daemon prio=10 tid=0x00007fc22001a000 nid=0x6ee3 runnable [0x00007fc242f92000]
java.lang.Thread.State: RUNNABLE
at sun.nio.ch.FileDispatcherImpl.read0(Native Method)
at sun.nio.ch.FileDispatcherImpl.read(FileDispatcherImpl.java:46)
at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223)
at sun.nio.ch.IOUtil.read(IOUtil.java:197)
at sun.nio.ch.FileChannelImpl.read(FileChannelImpl.java:149)
- locked <0x00000000e7739be8> (a java.lang.Object)
at org.jruby.util.io.ChannelDescriptor.read(ChannelDescriptor.java:604)
at org.jruby.util.io.ChannelDescriptor.read(ChannelDescriptor.java:574)
at org.jruby.RubyIO.sysread(RubyIO.java:2998)
at org.jruby.RubyIO$INVOKER$i$0$1$sysread.call(RubyIO$INVOKER$i$0$1$sysread.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:665)
at org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:206)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)
at org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)
at org.jruby.ast.DAsgnNode.interpret(DAsgnNode.java:110)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)
at org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:206)
at org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:157)
at org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:130)
at org.jruby.runtime.Block.yieldSpecific(Block.java:111)
at org.jruby.RubyKernel.loop(RubyKernel.java:1521)
at org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)
at org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)
at org.jruby.ast.FCallNoArgBlockNode.interpret(FCallNoArgBlockNode.java:32)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:204)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:206)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:177)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:183)
at org.jruby.ast.FCallOneArgBlockPassNode.interpret(FCallOneArgBlockPassNode.java:32)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:118)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.WhenOneArgNode.when(WhenOneArgNode.java:49)
at org.jruby.ast.CaseNode.interpret(CaseNode.java:133)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)
at org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:206)
at org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:194)
at org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:177)
at org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:140)
at org.jruby.runtime.Block.yieldSpecific(Block.java:129)
at rubyjit.FileWatch::Watch$$each_d9daf52dbd4f215d0c0e159875f0d2ade6f334d11663791523.block_1$RUBY$file(/var/tmp/logstash-1.4.2/vendor/bundle/jruby/1.9/gems/filewatch-0.5.1/lib/filewatch/watc:
at rubyjit$FileWatch::Watch$$each_d9daf52dbd4f215d0c0e159875f0d2ade6f334d11663791523$block_1$RUBY$file.call(rubyjit$FileWatch::Watch$$each_d9daf52dbd4f215d0c0e159875f0d2ade6f334d11663791523$block_1$RUBY$file)
at org.jruby.runtime.CompiledBlock19.yield(CompiledBlock19.java:135)
at org.jruby.runtime.Block.yield(Block.java:142)
at org.jruby.RubyArray.eachCommon(RubyArray.java:1606)
at org.jruby.RubyArray.each(RubyArray.java:1613)
at org.jruby.RubyArray$INVOKER$i$0$0$each.call(RubyArray$INVOKER$i$0$0$each.gen)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)
at org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)
at rubyjit.FileWatch::Watch$$each_d9daf52dbd4f215d0c0e159875f0d2ade6f334d11663791523.file(/var/tmp/logstash-1.4.2/vendor/bundle/jruby/1.9/gems/filewatch-0.5.1/lib/filewatch/watch.rb:60)
at rubyjit.FileWatch::Watch$$each_d9daf52dbd4f215d0c0e159875f0d2ade6f334d11663791523.file(/var/tmp/logstash-1.4.2/vendor/bundle/jruby/1.9/gems/filewatch-0.5.1/lib/filewatch/watch.rb)
at org.jruby.internal.runtime.methods.JittedMethod.call(JittedMethod.java:161)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:149)
at org.jruby.ast.FCallNoArgBlockPassNode.interpret(FCallNoArgBlockPassNode.java:27)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.WhileNode.interpret(WhileNode.java:131)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:247)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:222)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:356)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:213)
at org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:222)
at org.jruby.ast.CallTwoArgBlockNode.interpret(CallTwoArgBlockNode.java:62)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:161)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:190)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:316)
at org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:145)
at org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)
at org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)
at org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:206)
at org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:194)
at org.jruby.runtime.Interpreted19Block.call(Interpreted19Block.java:125)
at org.jruby.runtime.Block.call(Block.java:101)
at org.jruby.RubyProc.call(RubyProc.java:290)
at org.jruby.RubyProc.call(RubyProc.java:228)
at org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:99)
at java.lang.Thread.run(Thread.java:745)

path format error in file input result in cryptic exception

(This issue was originally filed by @edperry at elastic/logstash#2905)


no implicit conversion from nil to integer
=== I get the error only when running the /etc/init.d/logstash but I do not get this error when running it from the CLI bin/logstash -f ......

Config file is also at the bottom but since it works one way I would imagine the file is correct.

{:timestamp=>"2015-03-25T23:29:51.406000-0400", :message=>["org/jruby/RubyString.java:3690:in []'", "file:/opt/logstash/vendor/jar/jruby-complete-1.7.11.jar!/META-INF/jruby.home/lib/ruby/1.9/pathname.rb:48:inchop_basename'", "file:/opt/logstash/vendor/jar/jruby-complete-1.7.11.jar!/META-INF/jruby.home/lib/ruby/1.9/pathname.rb:222:in relative?'", "/opt/logstash/lib/logstash/inputs/file.rb:85:inregister'", "org/jruby/RubyArray.java:1613:in each'", "/opt/logstash/lib/logstash/inputs/file.rb:84:inregister'", "/opt/logstash/lib/logstash/pipeline.rb:135:in start_inputs'", "org/jruby/RubyArray.java:1613:ineach'", "/opt/logstash/lib/logstash/pipeline.rb:134:in start_inputs'", "/opt/logstash/lib/logstash/pipeline.rb:72:inrun'", "/opt/logstash/lib/logstash/agent.rb:139:in execute'", "/opt/logstash/lib/logstash/runner.rb:168:inrun'", "org/jruby/RubyProc.java:271:in call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.17/lib/stud/task.rb:12:ininitialize'"], :file=>"logstash/agent.rb", :line=>"151"}
{:timestamp=>"2015-03-25T23:36:20.078000-0400", :message=>"Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones", :level=>:warn}
{:timestamp=>"2015-03-25T23:36:20.444000-0400", :message=>"Using milestone 2 input plugin 'exec'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones", :level=>:warn}
{:timestamp=>"2015-03-25T23:36:20.580000-0400", :message=>"Using milestone 2 output plugin 'redis'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones", :level=>:warn}
{:timestamp=>"2015-03-25T23:36:22.675000-0400", :message=>"+---------------------------------------------------------+\n| An unexpected error occurred. This is probably a bug. |\n| You can find help with this problem in a few places: |\n| |\n| * chat: #logstash IRC channel on freenode irc. |\n| IRC via the web: http://goo.gl/TI4Ro |\n| * email: [email protected] |\n| * bug system: https://logstash.jira.com/ |\n| |\n+---------------------------------------------------------+\nThe error reported is: \n no implicit conversion from nil to integer"}


Config File

[root@rftwawebp01 ~]# ls /etc/logstash/conf.d/ | sort -n | while read line; do cat /etc/logstash/conf.d/$line; done
input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/updateIvtAppForProfile.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/wc-dataimport-buildindex.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/bin/stagingProp.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/instances/hbc_solr/httplogs/access_act_log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/instances/hbc_solr/httplogs/error_act_log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/instances/hbc_stg/httplogs/trace.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/instances/hbc_stg/logs/createInstanceANT.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/instances/hbc_stg/logs/sdo.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/acpload.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/config_ant.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_getPath.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/config.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/stagingProp.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/wc-dataimport-buildindex.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/wc-dataimport-preprocess.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/wcnonroot.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/CommerceServer70/logs/wc-seo-url-load.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/Plugins/logs/solrWebserver/http_plugin.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/Plugins/logs/webserver1/http_plugin.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/hamanager_config.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/importConfigArchive.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/keyGeneration.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/SetSecurity.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/SIBDefineChains.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/SIBGenericDeployRAs.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/amjrte_config.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/collect_metadata.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/copyFiles.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBMIHS/logs/access_log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr_create.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/createShortcutForProfile.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/generateProfileKey.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr_getPath.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/hamanager_config.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/importConfigArchive.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/keyGeneration.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/SetSecurity.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/SIBDefineChains.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/SIBGenericDeployRAs.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBMIHS/logs/error_log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_solr/wsadminListener.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/wsadminListener.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/listProfiles.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/validateRegistry.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/ModifyCloudscapePermission.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/product_StartMenu.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/update/updateconfigCIM.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/update/updateconfig.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/update/updatePerfTemplate.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/wc-dataimport-buildindex.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/executeUpdateProfileIvtApp.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/activity.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/addNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/backupConfig.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/ffdc/nodeagent_exception.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/ffdc/PRstgHBCserver1_exception.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/iscinstall.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/native_stderr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/native_stdout.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/amjrte_config.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/SystemErr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/SystemOut_15.03.22_22.28.52.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/nodeagent/SystemOut.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/native_stderr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/native_stdout.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/out.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/serverStatus.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/ssl.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/collect_metadata.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1 /stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/SystemErr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/SystemOut.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/trace2.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/PRstgHBCserver1/trace.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/removeNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/native_stderr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/native_stdout.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/serverStatus.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/copyFiles.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/SystemErr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/server1/SystemOut.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/serverStatus.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/syncNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/Update76692.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg/logs/wc-dataimport-buildindex.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/activity.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/addNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/ffdc/solrServer_exception.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg_create.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/hbc_stg_solr/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/iscinstall.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/native_stderr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/native_stdout.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/SystemErr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/nodeagent/SystemOut.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/removeNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/native_stderr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/createShortcutForProfile.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/native_stdout.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/startServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/stopServer.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/SystemErr.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/SystemOut.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/trace-app.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/trace-d1.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/solrServer/trace.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/syncNode.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/profiles/hbc_stg_solr/logs/Update76692.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
file {
path => ["/opt/IBM/WebSphere/AppServer/logs/manageprofiles/hbc_stg/generateProfileKey.log"]
type => "STG_WCS_LOGS"
exclude => [ "*gz" ]
}
}

input {
exec {
command => "echo 'heartbeat'"
interval => 1800
type => "heartbeat"
tags => ["heartbeat"]
}
}
input {
exec {
command => "ps -e -o user,pid,ppid,pcpu,pmem,time,vsz,rss,args"
interval => 300
type => "OS_STATS"
tags => ["ps"]
codec => "line"
}
}

input{
exec {
command => "/usr/bin/sar -u 1 1"
interval => 300
type => "OS_STATS"
tags => ["sar"]
codec => "line"
}
}

filter {
grok {
match => ["path","%{GREEDYDATA}/%{GREEDYDATA:filename}$"]
}
if [filename] =~ "trace.log" or
[filename] =~ "SystemOut.log" or
[filename] =~ "SystemErr.log" or
[filename] =~ "native_stderr.log"

    {
            multiline {
                pattern => "^\["
                negate  => true
                what => "previous"
            }

            grok{  
                    #break_on_match => false
                    match => [ "message", "%{SYSLOG5424SD}\s\w+\s+(?<component>\w+)\s+(?<t>\w+)(|\s+(?<text>.+))",
                               "message", "%{SYSLOG5424SD}\s\w+\s+(?<t>\w+)\s+%{JAVACLASS}\s+(|\s+(?<text>.+))",
                               "message", "%{SYSLOG5424SD}\s\w+\s+%{JAVACLASS}\s+(?<text>.+)"
                            ]
            }
            grok{  
                    break_on_match => false
                    match => [
                               "message", "lat=(?<ltitude>[-\d]+\.\d+),long=(?<longitude>[-\d]+\.\d+),"
                            ]
                    add_tag => [ "longlat" ]
            }
            if [lat] {
                     #mutate {
                     #     rename => [ "latitude", "[geoip][location][lat]", "longitude", "geoip.[location][lon]" ]
                     #}
                     mutate {
                            add_field => [ "geoip.location", "%{long}"]
                    }
                     mutate {
                      # Merge 'tmplat' into 'location'
                              merge => [ "geoip.location", "lat" ]
                     }
                     mutate {
                     #Convert our new array of strings back to float
                              convert => [ "geoip.location", "float" ]
                              add_tag => "geoip"
                     }
            }
 } else if [filename] =~ "hudsonbay.log"
 {
    multiline {
            pattern => "^\d+"
            negate  => true
            what => "previous"
    }

 }
 if [host] =~ "rftwwapp"
 {
    mutate { add_tag => "website" }

 } else if    [host] =~ "rftwwebp"
 {
    mutate { add_tag => "apache_website" }
 } else if    [host] =~ "rftmappp"
 {
    mutate { add_tag => "mobile" }
    mutate { add_tag => "apache_mobile" }
 } else if [host] =~ "rftwawebp01" {
    mutate { add_tag => "stage" }
    mutate { add_tag => "apache_staging" }
 } else if [host] =~ "rftwaappp01" {
    mutate { add_tag => "stage" }
 }

}
filter {
if [path] =~ "access_" {
grok {
match => [ "message" , "%{COMMONAPACHELOG} (?\d+) "%{DATA:referrer}" "%{DATA:agent}" "%{DATA:domain}" True-Client-IP "%{DATA:True-Client-IP}" "%{DATA:JSESSIONID}" "%{DATA:WAS}" "%{DATA:CACHED_RESPONSE>}" %{DATA:REDIRECT}" ]
}
}
if [path] =~ "http_plugin.log" {
grok {
match => [
"message" , "serverSetFailoverStatus: Server %{DATA:node} : pendingRequests (?\d+) failedRequests (?\d+) affinityRequests (?\d+) totalRequests (?\d+)" ,
"message" , "STATS: ws_server_group: serverGroupCheckServerStatus: Checking status of %{DATA:node}, ignoreWeights (?\d+), markedDown (?\d+), retryNow (?\d+), retryInSec (?[\d-]+), wlbAllows (?\d+) reachedMaxConnectionsLimit (?\d+)"
]
}

    }
    if "ps" in [tags] {
            grok {
                    match  =>  [
                    #ps -e -o user,pid,ppid,pcpu,pmem,time,vsz,rss,args
                    "message" , "%{DATA:uid}\s+%{NUMBER:pid:int}\s+%{NUMBER:ppid:int}\s+%{NUMBER:pcpu:float}\s+%{NUMBER:pmem:float}\s+%{NOTSPACE:time}\s+%{NUMBER:vsz:int}\s+%{NUMBER:rss:int}\s+%{DATA:cmd}\s+(?<args>.*)"
                    ]
            }
    }

}
filter{
if "sar" in [tags] {
grok {
match => [
#sar -u 1 1
#17:47:35 CPU %user %nice %system %iowait %steal %idle
#17:42:26 all 4.01 3.18 4.01 0.00 0.00 88.80
"message" , "(%{TIME:sartime}|%{DATA:average}:)\s+%{DATA:rowtype}\s+%{NUMBER:pctuser:float}\s+%{NUMBER:pctnice:float}\s+%{NUMBER:pctsystem:float}\s+%{NUMBER:pctiowait:float}\s+%{NUMBER:pctsteal:float}\s+%{NUMBER:pctidle:float}"
]
}
}
}

output {
if "debugme" in [tags] {
stdout { codec => rubydebug }
}
redis {
batch => true # boolean (optional), default: false
batch_events => 50 # number (optional), default: 50
batch_timeout => 60 # number (optional), default: 5
#codec => plain # codec (optional), default: "plain"
#congestion_interval => 1 # number (optional), default: 1
#congestion_threshold => 0 # number (optional), default: 0
data_type => "list" # string, one of "list", "channel"
#db => 0 # number (optional), default: 0
host => ["XXXXXXXX"] # array (optional), default: ["127.0.0.1"]
key => "dsg" # string (optional)
#password => ... # password (optional)
#port => ... # number (optional), default: 6379
reconnect_interval => 1 # number (optional), default: 1
#shuffle_hosts => ... # boolean (optional), default: true
#timeout => 5 # number (optional), default: 5
workers => 5 # number (optional), default: 1
}
}

Windows - Process cannot access the file

Brand new to logstash.. I downloaded version 1.5 today and went through the getting started tutorials and such. Everything worked there. Now when I try to read my log files, I get an error "The process cannot access the file because it is being used by another process." The log file is from Go-Cd build agent, all written in java. I'm able to open the log file in notepad or any other text editor. Why can't the log stash input file plugin read it? Are there any workarounds this this?

λ logstash -e 'input{ file { path => "D:\Go Agent\go-agent.log" } } output { stdout{ } }'
The process cannot access the file because it is being used by another process.

I've seen this reported as an issue on earlier versions of logstash. One example is here: https://logstash.jira.com/browse/LOGSTASH-986. I saw somewhere that this problem would be fixed in logstash 1.5 because of a downstream fix in filewatcher .6.1.

Thanks!

File input appears to stop reading from NFS when rsyncing files

(This issue was originally filed by @ScottChapman at elastic/logstash#2803)


So, I have a file input clause, and logstash is actively reading files from an NFS share.

Then rsync comes along and updates files, and my logstash just stops.

I've watched the files that are getting updated, and no new files, and no inode changes. Just a log file increases in size.

I can do a tail -f on the file and that runs just fine which rsync-ing.

Any ideas?

Error: undefined method `+' for nil:NilClass on log rotation

I'm hitting up against a situation where the LogStash::Inputs::File runs into an unrecoverable error. I thought it might have been an issue with the input data itself, until I witnessed it happening across multiple logs on multiple servers all at the same time.

All the times were shortly after midnight GMT, when the logs get rotated. I can confirm that the errors correlate to the times of the log rotation.

Here is a sample of the error, complete with --debug stack trace, on one of the hosts:
http://pastebin.com/Xr2FdVtP

Adding new files to dir will cause file input to stop working

To reproduce :

logstash file input config :

    file {
        path => ["/opt/data/*-access.log"]
        sincedb_path => "/opt/data/nginx-access.db"
        codec => json
        type => "nginx"
    }
  • start logstash
  • logstash initiate the sincedb file
  • add some logs
  • sincedb file "last line number" is registered
  • stop logstash
  • empty the log file
  • start logstash
  • logstash is trying to reach the last line seen (it seems) and gives an error :
{:timestamp=>"2015-06-12T21:48:58.533000+0200", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::File path=>[\"/opt/data/*-access.log\"], sincedb_path=>\"/opt/data/nginx-access.db\", tags=>[], type=>\"nginx\", start_position=>\"end\", delimiter=>\"\\n\">\n  Error: can't convert Array into String", :level=>:error}

Note that I'm using the JSON codec and this issue seems to go away when using "plain" codec...

NotImplementedError: stat.st_dev unsupported or native support failed to load

Hi!
I using Ubuntu 12.04 x64 + logstash_1.4.2-1-2c0f5a1_all.deb and logstash_1.5.0.rc2-1_all.deb
When logstash start i see error:
NotImplementedError: stat.st_dev unsupported or native support failed to load
dev_major at org/jruby/RubyFileStat.java:188
_discover_file at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.1/lib/filewatch/watch.rb:150
each at org/jruby/RubyArray.java:1613
_discover_file at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.1/lib/filewatch/watch.rb:132
watch at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.1/lib/filewatch/watch.rb:38
tail at /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.1/lib/filewatch/tail.rb:68
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.6/lib/logstash/inputs/file.rb:133
each at org/jruby/RubyArray.java:1613
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.6/lib/logstash/inputs/file.rb:133
inputworker at /opt/logstash/lib/logstash/pipeline.rb:174
start_input at /opt/logstash/lib/logstash/pipeline.rb:168

In posible solution: remove "noexec" flag from tmp - but it not secure!
config file:
input {
file {
codec => "json_lines"
path => "/var/log/logstash/message.log" #any txt log with full permission to logstash user
discover_interval => 1
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

Failing test

Failures:

  1. inputs/file should restarts at the sincedb value
    Failure/Error: Unable to find matching line from backtrace
    NoMethodError:
    undefined method `quit' for nil:NilClass

    ./lib/logstash/inputs/file.rb:152:in`teardown'

  2. inputs/file should start at the beginning of an existing file
    Failure/Error: Unable to find matching line from backtrace
    NoMethodError:
    undefined method `quit' for nil:NilClass

    ./lib/logstash/inputs/file.rb:152:in`teardown'

Finished in 1.81 seconds
3 examples, 2 failures

add a setting to disable sincedb

Right now, if users on a unix operating system wish to not use sincedb they can either use the logstash-input-stdin (and do cat file.log | bin/logstash -f config) or use "/dev/null" as a sincedb_path.
Windows users don't have either option so maybe disabling sincedb should be a setting in this plugin.

Suggestions on implementing this:

  1. setting the string "null" as sincedb_path (treating that as a special case)
  2. have separate boolean config parameter like use_sincedb (enabled by default)

Other suggestions?

Process order when catching up and monitoring

From a user:


We found ourselves in situation where some logs did not get parsed from Feb 6th-10th.
I found that I could touch unparsed files and restarted the logstash forwarder that would re-harvest older files.
My question is if there are 10’s of 1000s of files how long can that take? How can I force it to specify which files to parse first? Any tips for this sort of situation? How do we monitor if log parsing stops – any mechanisms to monitor."


buffering causing duplicate messages on logstash restart

from elastic/logstash#1679


Symptom
Restarting logstash while it is reading a large file will cause it to duplicate some messages.

Cause
I think it is the buffering in tail.rb (_read_file) from ruby-filewatch. tail.rb reads the file in 16KB chunks, but doesn't update it's in-memory sincedb until all 16KB have been sent to logstash (and presumably processed - I don't yet understand how file.rb is wired in).

Possible Fix - slow
Reading in smaller chunks - using a 25 byte buffer caused no messages to be duplicate but a few to be dropped.

Possible Fix - faster
Update the in-memory sincedb hash after yielding each line (e.g. sincedb[inode] = filepos + line.length). Not sure how multi-byte character encodings are handled in ruby and/or logstash.

Any thoughts? I'd be willing to work on a fix with some direction.


Allow to throttle between read files

Rephrased from LOGSTASH-818

When using start_position => beginning and a glob in path, the input will read fully each discovered files before reading the next one(s).
Dependending of the file size and the pipeline throughput, it can be interpreted as "starvation" for specific source files.
This input and the underlying filewatch library should allow to switch between file more frequently, maybe by defining a max_read configuration.

Plugin should log permission errors to logstash.log

I installed logstash 1.5 using the debian installer and set up a test conf to read apache logs and output to a file in /tmp/. However, nothing was being output to the file and no errors were appearing in /var/log/logstash/logstash.log

I discovered the problem was caused by logstash not having permission to read the apache log. I had to mess around with running logstash manually (rather than through init) and adding verbose logging, etc. and even still, there was no indication in the logs. This problem would have been a lot quicker for me to solve if there was an error in the logstash log saying that it had insufficient permissions to read the file.

Files on NFS volume vs sincedb

My logs are on a NFS volume. They are correctly parsed. After reboot, they are parsed again.

The reason is the sincedb format. This file identifies processed file with their major+minor+inode. minor is not the same each time the same NFS volume is mounted on the same NFS client. Therefore, the old files are seen as new files after reboot.

Why not identify processed files with full path ?

[windows] sincedb_write compains about permissions on first execution

The first time sincedb is written, it prints an error message, but works. Test scenario below:

config:

input { file  {
 path => "c:\test\teste.txt" 
 start_position => "beginning"
 sincedb_path => "c:\test\meh"
 }
}
output { stdout { codec => rubydebug } }

sincedb_file c:\test\meh doesn't exit:

C:\logstash-1.5.0.rc2>dir c:\test\meh
 Volume in drive C has no label.
 Volume Serial Number is 1C3E-1A1F

 Directory of c:\test

File Not Found

C:\logstash-1.5.0.rc2>dir c:\test\meh.new
 Volume in drive C has no label.
 Volume Serial Number is 1C3E-1A1F

 Directory of c:\test

File Not Found

run first time, write line to file, save, see it printed, exit logstash

C:\logstash-1.5.0.rc2>bin\logstash -f "c:\test\config.txt"
Logstash startup completed
{
       "message" => "teste\r",
      "@version" => "1",
    "@timestamp" => "2015-03-06T12:17:20.290Z",
          "host" => "Jsvd-VAIO",
          "path" => "c:\\test\\teste.txt"
}
←[33mSIGINT received. Shutting down the pipeline. {:level=>:warn}←[0m^
CTerminate batch job (Y/N)? ←[33m_sincedb_write rename/sync failed: c:\test\meh.
new -> c:\test\meh: Permission denied - c:\test\meh.new or c:\test\meh {:level=>
:warn}←[0m
Logstash shutdown completed

^C

An error message is printed. The sincedb file was created:

C:\logstash-1.5.0.rc2>dir c:\test\meh
 Volume in drive C has no label.
 Volume Serial Number is 1C3E-1A1F

 Directory of c:\test

06-03-2015  12:17                32 meh
               1 File(s)             32 bytes
               0 Dir(s)  18.763.636.736 bytes free

Relaunching logstash the message isn't written again, so the save point worked. Writing a second message "teste2" works:

C:\logstash-1.5.0.rc2>bin\logstash -f "c:\test\config.txt"
Logstash startup completed
{
       "message" => "teste2\r",
      "@version" => "1",
    "@timestamp" => "2015-03-06T12:17:56.209Z",
          "host" => "Jsvd-VAIO",
          "path" => "c:\\test\\teste.txt"
}
^C←[33mSIGINT received. Shutting down the pipeline. {:level=>:warn}←[0m
Logstash shutdown completed
Terminate batch job (Y/N)?
^C
C:\logstash-1.5.0.rc2>

Plugin overwrites event's "path" field

From file.rb#L140:L141:

    event["host"] = hostname if !event.include?("host")
    event["path"] = path

After codec processing, the plugin overwrites the event's path field without first checking if it exists. I'm using the json codec to parse objects with a path field, so this was a little unexpected.

Option to just read from files (without continuously watching them)

When using file input against files that are static (will not be appended to anymore), it will be nice to provide an option to exit the LS pipeline once the files have been read (instead of keeping the process running and keep watching for new streams). This will allow the end user to schedule periodic runs to read from files and exit when done.

File input w/ multiline codec merges lines from different files.

(This issue was originally filed by @jordansissel at elastic/logstash#1754)


Reproducing:

% cat > /tmp/x.a
Hello

% cat > /tmp/x.b
   world
  fizzle

% cat > /tmp/x.a
fancy pants

Logstash config:

% bin/logstash -e 'input { file { path => "/tmp/x.?" codec => multiline { pattern => "^\s" what => previous } } }'
{
  "@timestamp" => "2014-09-19T00:12:14.243Z",
  "message"    => "Hello\n   world\n  fizzle",
  "@version"   => "1",
  "tags"       => [
    [0] "multiline"
  ],
  "host"       => "oh-my",
  "path"       => "/tmp/x.a"
}

Unexpectedly, the lines from /tmp/x.b are included in a message from /tmp/x.a.

A brief review of the file input makes the cause of this pretty clear; the @codec is not unique per file.

Delete lines after they were read

When Logstash reads my log files and stores them in Elasticsearch, they are both stored in the source file and Elasticsearch.
It would be awesome to have a way to prevent this (by deleting the lines after reading), like delete_read => true.

Add newer_than option to file input.

(This issue was originally filed by @stp72 at elastic/logstash#2224)


I'm trying to use the logstash file input to ingest logs. The directory structure is as follows /logs/YYYY/MM/DD/<log_file_name_with_date_time_stamp>. It would be nice to be able to have a newer_than option in order to limit what files are ingested either by the file's date timestamp or via an expression to parse out the date timestamp from the file name. It would also be nice if it could handle relative dates as in 5d for anything new in the last 5 days, etc.

Thanks!

File Input should have option to spawn multiple reader threads

Scenario: I have a lot of different files that logstash monitors. (One logfile per webserver)
If, for whatever reason, logstash crashes or I need to reboot - it can take a very long time (hours, or more) for logstash to be able to catch up again, as it reads one file at a time per input.

The current solution seems to be to create multiple file inputs, which does work. However this creates a management overhead (many file input entries). If I use any kind of 'elastic' capability to spin up/down servers on demand managing (and restarting) logstash configuration becomes particularly difficult.

Suggested solution: Provide a 'readers' option that lets me specify the number of readers I'd like logstash to spin up.

(originally logged as /logstash/issues/2930)

[logstash 1.4.2] : error with sincedb with multi file

(This issue was originally filed by @Ced1984 at elastic/logstash#1907)


hello,
When we define more than one file in the input entry, the new log files lines are not seen:

input {
  file {
    type => "log4j"
    path => "/usr/users/gacna*/DATA/ARE/LOG/*.log"
  }
}

The .sincedb file contains only one line:
cat .sincedb_498811a631a0364cebbcb69f2a736b2a
0 440023

This error appears in version 1.4.2.

Ordering of matched files being watched

The Request:

This is more of an enhancement request to add support for the matched files to be watched in the order of their timestamp oldest to newest and or add an option to define the some ordering behaviors.

The problem

Given: path => "/tmp/file.*.json"

Right now the ordering of watched files appear to be based on whatever order glob returns. This leads to situations where a newer file ends up being watched before an older one.

In my case I need logstash to respect this historical order of the matched files, otherwise it leads to the old data being considered the latest version. (i get around this by aggressively pruning old files that i "think" are done and when I run into this issue I end up having to reload the latest data manually).


Is anyone else running into this?

Logstash does not properly pick up the last position in file on restart

(This issue was originally filed by @jchalos at elastic/logstash#2246)


Symptom: Logstash misses log events when using the file input if the logstash process is restarted or stops unexpectedly and is restarted. It appears that the sincedb file is not being utilized on startup.

Utilizing 'start_from => "beginning"' will result in duplicate data and is not the intended behavior. It should pick up the log from the last read position when re-starting.

Logstash version:1.4.2

Reproduction:

input {
file {
path => "/tmp/**/*.log"
sincedb_path = "/tmp/logstash.sincedb"
}
}

  1. Start logstash
  2. Append data to multiple logs in the directories being scanned.
  3. Stop logstash
  4. Append additional data to logs(This data will be missing including all data appended to the logs while logstash is starting)
  5. Start logstash
  6. Append additional data to logs(Eventually the logs will be read from the end again)

Redundant sincedb_write in teardown

EDIT: Sorry, I should have searched before. This is the same issue as #15. Is there a reason why it is still open?

Nothing big but it is redundant and a bit misleading.

In the teardown function:

public
def teardown
  if @tail
    @tail.sincedb_write
    @tail.quit
    @tail = nil
  end
end # def teardown

@tail.sincedb_write is called right before a @tail.quit
If you look into the Filewatch Tail Code, you'll find that @tail.quit calls @tail._sincedb_write

# from filewatch/tail.rb
public
def quit
  _sincedb_write
  @watch.quit
end # def quit

Which is essential @tail.sincedb_write except with a logger statement.

# from filewatch/tail.rb
public
def sincedb_write(reason=nil)
  @logger.debug? && @logger.debug("caller requested sincedb write (#{reason})")
  _sincedb_write
end

I am not sure if this was done purposefully to have that debugging statement, but the redundant code is misleading. It makes it seem that the @watch.quit does not write to the file when it does. At the very least, it caught me off guard when I was trying to further extend the file plugin for my own use case.

Windows test failures

Once past the test crashes in #9 , the test fails on windows:

C:\logstash>bin\logstash rspec vendor\bundle\jruby\1.9\gems\logstash-input-file-
0.1.3\spec\inputs\file_spec.rb
Using Accessor#strict_set for specs
Run options: exclude {:redis=>true, :socket=>true, :performance=>true, :couchdb=
>true, :elasticsearch=>true, :elasticsearch_secure=>true, :broken=>true, :export
_cypher=>true, :integration=>true}
FFF

Failures:

  1) inputs/file restarts at the sincedb value inputs
     Failure/Error: block.call(pipeline, queue)
     Insist::Failure:
       Expected "foo", but got "foo\r"
     # C:\logstash\lib\logstash\runner.rb:58:in `run'
     # C:\logstash\lib\logstash\runner.rb:113:in `run'
     # C:\logstash\lib\logstash\runner.rb:171:in `run'

  2) inputs/file starts at the end of an existing file inputs
     Failure/Error: block.call(pipeline, queue)
     Insist::Failure:
       Expected "hello", but got "hello\r"
     # C:\logstash\lib\logstash\runner.rb:58:in `run'
     # C:\logstash\lib\logstash\runner.rb:113:in `run'
     # C:\logstash\lib\logstash\runner.rb:171:in `run'

  3) inputs/file can start at the beginning of an existing file inputs
     Failure/Error: block.call(pipeline, queue)
     Insist::Failure:
       Expected "hello", but got "hello\r"
     # C:\logstash\lib\logstash\runner.rb:58:in `run'
     # C:\logstash\lib\logstash\runner.rb:113:in `run'
     # C:\logstash\lib\logstash\runner.rb:171:in `run'

Finished in 1.87 seconds
3 examples, 3 failures

Defining a development gem in the gemfile and specifying the :path doesn't add it to the loadpath.

Logstash use the Gemfile to install gems but doesn't use it to modify the load path of the application.
So if you add this line to your gemfile (useful to test an unreleased gems...):

gem "logstash-devutils", :path => "~/es/logstash-devutils"

The ~/es/logstash/lib wont be added to the application $LOAD_PATH and the tests will fail with

LoadError: no such file to load -- logstash/devutils/rspec/spec_helper

the :git option might fail too?

Input failing on linux

I see elastic/logstash#2135 and jordansissel/ruby-filewatch#39 but this issue seems to affect linux as well which is pointed out in elastic/logstash#2135

Seems like a show stopper really. I'm experiencing it in the latest 1.5 branch.

Here is some output from the debug log:

{:timestamp=>"2015-01-13T17:29:07.580000+0000", :message=>"_discover_file_glob: /var/log/httpd/access_log_json*: glob is: [\"/var/log/httpd/access_log_json-1421168400\"]", :level=>:debug, :file=>"filewatch/watch.rb", :line=>"117"}
{:timestamp=>"2015-01-13T17:29:19.591000+0000", :message=>"/var/log/httpd/access_log_json-1421168400: file grew, old size 7022, new size 7427", :level=>:debug, :file=>"filewatch/watch.rb", :line=>"81"}

But it is clear that the file is growing:

[root@ip-10-79-177-22 logstash]# ls -al /var/log/httpd/access_log_json*
-rw-r--r-- 1 root root 200034 Jan 13 17:59 /var/log/httpd/access_log_json-1421168400
-rw-r--r-- 1 root root  64038 Jan 13 18:10 /var/log/httpd/access_log_json-1421172000

The logger seems hung up. I have a heap dump if you want.

I've experienced the buggy behavior in a number of ways:

  • logstash starts and it finds nothing, I get no logs
  • logstash starts, gets some logs but ceases running others
  • logstash works fine

Normally if I restart the daemon it runs fine but I'm unsure for how long really.

Here is the config:

input {
    file {
        start_position => "beginning"
        path => ["/var/log/cloud-init*",
                 "/var/log/cfn-init*",
                 "/var/log/cfn-wire*"]
        type => "aws-ec2-logs"
    }
}
filter {
    mutate {remove_field => ["source_host"]}
    mutate {
        add_field => {
            "[aws][cloudformation][stack-name]" => "app-logstash"
            "[aws][ec2][instance-id]" => "i-aaaaaaaa"
            "[aws][ec2][ami-id]" => "ami-aaaaaaaa"
            "[aws][ec2][instance-type]" => "c3.large"
            "[aws][ec2][placement]" => "us-east-1c"
            "[aws][ec2][public-hostname]" => "ec2-1-1-1-1.compute-1.amazonaws.com"
            "stage" => "staging"
            "source_host" => "ip-1-1-1-1"
            "[aws][autoscaling][groupName]" => "app-logstash-AutoScalingGroup-AAAAAAAAAAAA"
        }
    }
    if [path] == "/var/log/cloud-init.log" {
        grok { match => ["message", "%{SYSLOGTIMESTAMP:timestamp} %{DATA:logger_name}\[%{NUMBER:pid}\]: %{DATA:filename}\[%{WORD:levelname}\]: %{GREEDYDATA:data}"] }
        date { match => ["timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"] }
        mutate {
            remove_field => ["timestamp"]
            rename => ["data", "message"]
        }
    }
    if [path] in ["/var/log/cfn-init.log", "/var/log/cfn-wire.log"] {
        grok { match => ["message", "%{TIMESTAMP_ISO8601:timestamp} \[%{WORD:levelname}\] %{GREEDYDATA:data}"] }
        date { match => ["timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"] }
        mutate {
            remove_field => ["timestamp"]
            rename => ["data", "message"]
        }
    }
}
output {
    if [type] == "aws-ec2-logs" {
        kafka {
            broker_list => "kafka:9092"
            topic_id => "aws-ec2-logs"
            compression_codec => "gzip"
            codec => json {}
        }
    }
}
input {
    file {
        path => ["/var/log/tomcat6/gc.log*"]
        type => "jvm-gc"
    }
}
filter {
    if [type] == "jvm-gc" {
        grok {
            match => ["message", "GC%{TIMESTAMP_ISO8601:timestamp}: %{NUMBER}: %{GREEDYDATA:data}"]
            match => ["message", "%{TIMESTAMP_ISO8601:timestamp}: %{NUMBER}: %{GREEDYDATA:data}"]

        }
        date {match => ["timestamp", "ISO8601"]}
        mutate {
            remove_field => ["timestamp"]
            rename => ["data", "message"]
        }
    }
}
output {
    if [type] == "jvm-gc" {
        kafka {
            broker_list => "kafka:9092"
            topic_id => "jvm-gc"
            compression_codec => "gzip"
            codec => json {}
        }
    }
}
input {
  file {
    path => ["/var/log/httpd/access_log_json*"]
    type => "apache22"
    codec => json {}
  }
}
output {
  if [type] == "apache22" {
      kafka {
        broker_list => "kafka:9092"
        topic_id => "apache22"
        compression_codec => "gzip"
        codec => json {}
      }
  }
}
input {
  file {
    path => ["/var/log/tomcat6/rk-json.log", "/var/log/tomcat6/tomcat-json.log"]
    type => "tomcat6"
    codec => json {}
  }
}
output {
  if [type] == "tomcat6" {
      kafka {
        broker_list => "kafka:9092"
        topic_id => "tomcat6"
        compression_codec => "gzip"
        codec => json {}
      }
  }
}

Include file statistics with event

When using (or abusing) the file input it would be helpful to have the creation and modification times available. There are often times when logs have only partial timestamps listed like day and month. If the log file has a viable timestamp we can use that to supplement.

Logstash randomly stops sending access_log events to elasticsearch

(This issue was originally filed by @CoderTux at elastic/logstash#2848)


Hi guys,

Since a few days ago I've noticed a weird issue with logstash. We're using it with the file input for a java app running on tomcat. We have a few custom logfiles configured that have worked fine for months, but we recently added tomcat's access_log with a file input, and it randomly fails. There are no errors in the logfiles as far as I can tell, but I have noticed that removing the sincedb file for the access_log temporarily resolves the problem.

We're using logrotate with the copytruncate option to rotate the logs, but the issue doesn't seem to be linked to the log rotation.

Any ideas what could be going wrong?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.