1

I'm setting logstash for nginx error log, and output is ElasticSearch(ES)/Kibana. Reading log from files is good, but in ES, all of timestamp is 15:00:00 UTC. (I'm korean, and 15 UTC is midnight at korea.) It seems that logstash read log files at Once. (As you know, nginx log file is daily recorded.)

I just want to get log in real-time What is the problem?

I tried to fix that problem. so in pipeline conf, input-file configuration is

  file {

    path => "/home/<path>/<to>/nginx/logs/error.log.*"
    start_position => beginning
    sincedb_write_interval => 5
    discover_interval => 10  #new file discover
    stat_interval => 1  #
    sincedb_path => "/dev/null"
  }

but is not working..

aibees
  • 11
  • 3

0 Answers0