My config file is shown below:
input {
file {
codec => "json"
path => "/home/data/*"
sincedb_path => "/dev/null"
}
}
output {
elasticsearch{
protocol => "http"
host => "localhost"
index => "data"
}
}
When I download a .json file to the data
directory, logstash will not receive the data or output to elasticsearch unless I first open the file and save it in gedit.
Running logstash with the -vvv
flag shows no errors all I get when a file is put in that directory is
_discover_file: /home/data/*: new: /home/data/prediction1.json (exclude is []) {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"126"}
_open_file: /home/data/prediction1.json: opening {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"98"}
/home/data/prediction1.json: staying at position 0, no sincedb {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"143"}
writing sincedb (delta since last write = 377) {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"177"}
/home/data/prediction1.json: file grew, old size 0, new size 3952 {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"81"}
This led me to believe that there may be a character encoding problem as the json file is created using json.dumps
in python before reaching elasticsearch. I tried converting the data to yaml:
outfile.write(yaml.dump(json.dumps(data)))
which logstash accepts as plain text as it is now in the form:
'data:{ properties:
{ location:
{ here }}}'
after using sed and tr commands to convert this BACK to valid json logstash no longer accepts it unless saved through gedit!!!