Apache logstash output do not show output

Question

I am trying to use logstash with apache tomcat logs. I have below in my conf file. When i run this conf file i get no error messages but also i do not get anything printed on the output file.

Would you be able to advise please?

input {
  file {
    path => "/opt/knime/apache-tomcat-9.0.36/logs/catalina.2021-04-06.log"
  }
}


       grok{
      patterns_dir => "/etc/logstash/patterns"
      match => { "message" => "%{MY_DATE_PATTERN:timestamp}%{SPACE}%{GREEDYDATA:dvaction}%{SPACE}%{COMMONAPACHELOG}"
      }
    }
    date {
      match => [ "timestamp" , "dd-MMM-yyyy HH:mm:ss.SSS" ]
         }
    }

    


output {
    stdout {
          codec => "json"
    }
    file {
             path =>"/var/log/logstash/testoutput.log"}
 }

Answer 1

By default a file input will skip to the end of the file and only read new lines as they are appended to the file. You may want to use the start_position option, possibly with a sincedb_path to persist the in-memory sincedb across restarts. Also, consider whether you want to use tail or read mode.

Answer 2

I was able to troubleshoot this. The issue was that logstash was not able to read from the log files because log files were owned by another user. Adding logststash user to the log files owner group has fixed the issue.

Thanks all again