0

I am new to logstash and during my hands on I could see that logstash do not process the last line of the log file.

My log file is simple 10 lines and I have configured filters to process one/two fields and output the json result to a new file.

So when logstash is running I open the monitored file and add one line to the end of file and save it. Nothing happens. Now I add one more line and the previous event shows up in the output file, and similarly for the next events.

How to resolve this behavior ? Is something wrong with my usecase/config ?

# The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
    file {
        path => "C:\testing_temp\logstash-test01.log"
        start_position => beginning 
    }
}
# The filter part of this file is commented out to indicate that it is
# optional.
filter {
    grok {
        match => { "message" => "%{IP:clientip} pssc=%{NUMBER:response} cqhm=%{WORD:HTTPRequest}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    file {
    path => "C:\testing_temp\output.txt"
}
}
4

1 に答える 1