On Friday, May 01, 2015 at 21:04 CEST,
Sitka <sitkaw...@gmail.com> wrote:
> I have a file of logging records I am using to debug some "filter"
> parses. I am using "file" input and have set "starting_position" to
> "beginning". So I startup logstash see what I get and killed it and
> make fixes and go again. I have seen if sometimes it reads the file
> and sometimes not. I ran some experiments and found that if I delete
> the file and rewrite it and then start up logstash it reads the file.
> If I have previously read the file, then when logstash starts it
> doesn't read the file despite being told to start at beginning.
> Am I missing something here? Is this intended behavior or a possible
> bug?
This is the intended behavior and documented at
http://logstash.net/docs/1.4.2/inputs/file#start_position:
"This option only modifies 'first contact' situations where
a file is new and not seen before. If a file has already
been seen before, this option has no effect."
If you want to force Logstash to reprocess a file, delete
the corresponding sincedb file (or entry within such a file).
For testing purposes it's much more convenient to use the
stdin input.
Next time, please post Logstash questions like this one to the
logstash-users list.
--
Magnus Bäck | Software Engineer, Development Tools
magnus.b...@sonymobile.com | Sony Mobile Communications
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to elasticsearch+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/20150504064649.GA19365%40seldlx20533.corpusers.net.
For more options, visit https://groups.google.com/d/optout.
