elasticsearchlogstashlogstash-configuration

Logstash - File Input - Changes on file don't affect

I'm running Logstash with docker on my machine with this command:

docker run  -it  -v /usr/share/logstash/config/logstash.conf:/Users/igunel/Desktop/logstash.conf --name myLogstash --network=elastic-network  -e "ssl_certificate_verification=false" logstash:8.8.1

The logstash.conf file is like this:

input {
 file { 
 path => '/Users/igunel/Desktop/SpringBootELK.log'
 }
}
output {
 file {
 path => '/Users/igunel/Desktop/output.txt'
 codec => rubydebug
  }
}

When I edit the SpringBootELK.log, there is no affect on logstash. The output.txt file is not being created. What is the wrong point? Why don't changes have any affect?

Solution

  • You mapped your logstash config the wrong way, it should be localhost:container, not the opposite.

    You also need to create a volume to map your local files in /Users/igunel/Desktop to container-local files so that Logstash can read SpringBootELK.log and write to output.txt.

    Run it like this:

    docker run  -it \ 
  -v /Users/igunel/Desktop/SpringBootELK.log:/var/log/logstash/SpringBootELK.log \
  -v /Users/igunel/Desktop/output.txt:/var/log/logstash/output.txt \
  -v /Users/igunel/Desktop/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \ 
  --name myLogstash \
  --network=elastic-network \
  -e "ssl_certificate_verification=false" logstash:8.8.1

    And you also need to modify your logstash.conf file as follows:

    input {
 file { 
 path => '/var/log/logstash/SpringBootELK.log'
 }
}
output {
 file {
 path => '/var/log/logstash/output.txt'
 codec => rubydebug
  }
}