title: How to process old Logs with Logstash
body: <p>I am trying to process 'old' log files on my local ELK stack (macOs), but I can't get Logstash to read my files.</p>
  
  <pre><code>{"eventid": "cowrie.direct-tcpip.data", "timestamp": "2016-07-10T03:00:17.713013Z", "format": "direct-tcp forward to %(dst_ip)s:%(dst_port)s with data %(data)s", "sensor": "sensor", "system": "says message", "src_ip": "8.8.8.8", "session": "session", "dst_port": 25, "dst_ip": "0.0.0.0", "message": "message'", "data": "data", "isError": 0}
  </code></pre>
  
  <p>When I input one line on STDIN, it works fine. ( But some of the lines are too big to de copy pasted as STDIN)</p>
  
  <pre><code>input {
         # this is the actual live log file to monitor
         file {
                path =&gt; "/Users/Auyer/ELK/ServerLogs/cowrie.json"
                start_position =&gt; beginning
                ignore_older =&gt; 0
                sincedb_path =&gt; "/Users/Auyer/ELK/ServerLogs/cowrie.sincedb"
                codec =&gt; json_lines
                sincedb_write_interval =&gt; 15
                discover_interval =&gt; 5
         }
         stdin{
         codec =&gt;json_lines
         type =&gt; "cowrie"
         }
  
  }
  
  filter {
      if [type] == "cowrie" {
  
          json {
              source =&gt; message
          }
  
          date {
              match =&gt; [ "timestamp", "ISO8601" ]
          }
  
          if [src_ip]  {
  
              dns {
                  reverse =&gt; [ "src_host", "src_ip" ]
                  action =&gt; "append"
              }
  
              geoip {
                  source =&gt; "src_ip"
                  target =&gt; "geoip"
                  database =&gt; "/Users/Auyer/ELK/logstash-2.3.3/vendor/geoip/GeoLiteCity.dat"
                  add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                  add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
              }
  
              geoip {
                  source =&gt; "src_ip"
                  database =&gt; "/Users/Auyer/ELK/logstash-2.3.3/vendor/geoip/GeoIPASNum.dat"
              }
  
              mutate {
                  convert =&gt; [ "[geoip][coordinates]", "float" ]
              }
          }
      }
  }
  
  output {
      if [type] == "cowrie" {
          elasticsearch {
              hosts =&gt;  ["localhost:9200"]
          }
          file {
              path =&gt; "/Users/Auyer/ELK/tmp/cowrie-logstash.log"
              codec =&gt; json
          }
          stdout {
              codec =&gt; rubydebug
          }
      }
  }
  </code></pre>
  
  <p>I have tried everything, read every Stack Overflow question, and nothing seems to work. </p>
  
  <p>Is there any other method I can use ?</p>