title: Logstash does not read Logfile
body: <p>I try to send a varnish-Access-Log provided by my admin as a .log file via Logstash to my Graylog2 instances. I am doing so with a lot of nginx log files, so i am wondering where I am stuck. Probably you can help me a bit further.</p>
  
  <p>I have tested everything twice with the grok debugger and everything is coming out fine. I am so stuck. in the debugger everything works, logstash does not find anything in the log files. Never had that before.</p>
  
  <p>Here is my simple Config for Logstash</p>
  
  <pre><code>input {
    file {
      path =&gt; ["/var/log/varnish/varnish.log"]
      type =&gt; "apachecombined"
    }
  }
  filter {
    grok { 
      type =&gt; "apachecombined"
      match =&gt; ["message", '%{IP:client} %{TIMESTAMP_ISO8601:timestamp} "%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} %{NUMBER:responsesize} "%{DATA:referer}" "%{DATA:useragent}" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}']
    }
  }
  output {
      gelf {
        host =&gt; "192.168.2.128"
        port =&gt; "12202"
        level =&gt; "info"
      }
  }
  </code></pre>
  
  <p>This is an extraction of the varnish-access-log:</p>
  
  <pre><code>85.182.210.74 2014-10-22T15:01:41+0200 "GET http://mydomain.de/favicon.ico HTTP/1.1" 200 1150 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36 OPR/25.0.1614.50" 0.000947 miss
  85.182.210.74 2014-10-22T15:01:42+0200 "GET http://mydomain.de/api/doc/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36 OPR/25.0.1614.50" 0.000836 miss
  17.47.221.166 2014-10-22T15:02:46+0200 "GET http://mydomain.de/stream/contents/2/page? HTTP/1.1" 200 2559 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B411 (5475740496)" 0.125556 miss
  17.47.221.166 2014-10-22T15:02:46+0200 "GET http://mydomain.de/stream/contents/1282/page? HTTP/1.1" 200 10312 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B411 (5475740496)" 0.130131 miss
  17.47.221.166 2014-10-22T15:02:47+0200 "GET http://mydomain.de/stream/view/home?&amp;page=0 HTTP/1.1" 200 53621 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B411 (5475740496)" 0.853203 miss
  17.47.221.166 2014-10-22T15:02:59+0200 "GET http://mydomain.de/stream/view/home?&amp;page=1 HTTP/1.1" 200 87788 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B411 (5475740496)" 0.857153 miss
  </code></pre>
  
  <p>This is the debug output of Logstash wich is NOT sending or recognizing anything:</p>
  
  <p>Reading config file {:file=>"logstash/agent.rb", :level=>:debug, :line=>"301"}   </p>
  
  <pre><code>Compiled pipeline code:   
  
  @inputs = []   
  
  @filters = []   
  
  @outputs = []   
  
  @input_file_1 = plugin("input", "file", LogStash::Util.hash_merge_many({ "path" =&gt; [("/var/log/varnish/varnish.log".force_encoding("UTF-8"))] }, { "type" =&gt; ("apachecombined".force_encoding("UTF-8")) }))   
  
  
  
  @inputs &lt;&lt; @input_file_1   
  
  @filter_grok_2 = plugin("filter", "grok", LogStash::Util.hash_merge_many({ "type" =&gt; ("apachecombined".force_encoding("UTF-8")) }, { "match" =&gt; [("message".force_encoding("UTF-8")), ("%{IP:client} %{TIMESTAMP_ISO8601:timestamp} \"%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} %{NUMBER:responsesize} \"%{DATA:referer}\" \"%{DATA:useragent}\" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}".force_encoding("UTF-8"))] }))   
  
  
  
  @filters &lt;&lt; @filter_grok_2   
  
  @output_gelf_3 = plugin("output", "gelf", LogStash::Util.hash_merge_many({ "host" =&gt; ("192.168.2.128".force_encoding("UTF-8")) }, { "port" =&gt; ("12202".force_encoding("UTF-8")) }, { "level" =&gt; ("info".force_encoding("UTF-8")) }))   
  
  
  
  @outputs &lt;&lt; @output_gelf_3   
  
    @filter_func = lambda do |event, &amp;block|   
  
      extra_events = []   
  
      @logger.debug? &amp;&amp; @logger.debug("filter received", :event =&gt; event.to_hash)   
  
      newevents = []   
  
      extra_events.each do |event|   
  
        @filter_grok_2.filter(event) do |newevent|   
  
          newevents &lt;&lt; newevent   
  
        end   
  
      end   
  
      extra_events += newevents   
  
      @filter_grok_2.filter(event) do |newevent|   
  
        extra_events &lt;&lt; newevent   
  
      end   
  
      if event.cancelled?   
  
        extra_events.each(&amp;block)   
  
        return   
  
      end   
  
  
  
      extra_events.each(&amp;block)   
  
    end   
  
    @output_func = lambda do |event, &amp;block|   
  
      @logger.debug? &amp;&amp; @logger.debug("output received", :event =&gt; event.to_hash)   
  
      @output_gelf_3.handle(event)   
  
  
  
    end {:level=&gt;:debug, :file=&gt;"logstash/pipeline.rb", :line=&gt;"26"}   
  
  Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones {:level=&gt;:warn, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"209"}   
  
  config LogStash::Codecs::Plain/@charset = "UTF-8" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@path = ["/var/log/varnish/varnish.log"] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@type = "apachecombined" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@debug = false {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@codec = &lt;LogStash::Codecs::Plain charset=&gt;"UTF-8"&gt; {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@add_field = {} {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@stat_interval = 1 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@discover_interval = 15 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@sincedb_write_interval = 15 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Inputs::File/@start_position = "end" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  You are using a deprecated config setting "type" set in grok. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. You can achieve this same behavior with the new conditionals, like: `if [type] == "sometype" { grok { ... } }`. If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=&gt;"type", :plugin=&gt;&lt;LogStash::Filters::Grok ---&gt;, :level=&gt;:warn, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"69"}   
  
  config LogStash::Filters::Grok/@type = "apachecombined" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@match = {"message"=&gt;"%{IP:client} %{TIMESTAMP_ISO8601:timestamp} \"%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} %{NUMBER:responsesize} \"%{DATA:referer}\" \"%{DATA:useragent}\" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}"} {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@tags = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@exclude_tags = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@add_tag = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@remove_tag = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@add_field = {} {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@remove_field = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@patterns_dir = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@drop_if_match = false {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@break_on_match = true {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@named_captures_only = true {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@keep_empty_captures = false {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@singles = true {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@tag_on_failure = ["_grokparsefailure"] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Filters::Grok/@overwrite = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  Using milestone 2 output plugin 'gelf'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2-modified/plugin-milestones {:level=&gt;:warn, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"209"}   
  
  config LogStash::Codecs::Plain/@charset = "UTF-8" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@host = "192.168.2.128" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@port = 12202 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@level = ["info"] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@type = "" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@tags = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@exclude_tags = [] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@codec = &lt;LogStash::Codecs::Plain charset=&gt;"UTF-8"&gt; {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@workers = 1 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@chunksize = 1420 {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@sender = "%{host}" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@ship_metadata = true {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@ship_tags = true {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@ignore_metadata = ["@timestamp", "@version", "severity", "host", "source_host", "source_path", "short_message"] {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@custom_fields = {} {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@full_message = "%{message}" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  config LogStash::Outputs::Gelf/@short_message = "short_message" {:level=&gt;:debug, :file=&gt;"logstash/config/mixin.rb", :line=&gt;"105"}   
  
  Registering file input {:path=&gt;["/var/log/varnish/varnish.log"], :level=&gt;:info, :file=&gt;"logstash/inputs/file.rb", :line=&gt;"74"}   
  
  No sincedb_path set, generating one based on the file path {:sincedb_path=&gt;"/root/.sincedb_a84185fecd92ea9dac476d36fa8cb7ff", :path=&gt;["/var/log/varnish/varnish.log"], :level=&gt;:info, :file=&gt;"logstash/inputs/file.rb", :line=&gt;"115"}   
  
  _sincedb_open: reading from /root/.sincedb_a84185fecd92ea9dac476d36fa8cb7ff {:level=&gt;:debug, :file=&gt;"filewatch/tail.rb", :line=&gt;"199"}   
  
  _discover_file_glob: /var/log/varnish/varnish.log: glob is: [] {:level=&gt;:debug, :file=&gt;"filewatch/watch.rb", :line=&gt;"117"}   
  
  Grok patterns path {:patterns_dir=&gt;["/opt/logstash/patterns/*"], :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"240"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/ruby", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/mongodb", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/redis", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/grok-patterns", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/linux-syslog", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/java", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/haproxy", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/mcollective", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/nagios", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/firewalls", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/mcollective-patterns", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/junos", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Grok loading patterns from file {:path=&gt;"/opt/logstash/patterns/postgresql", :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"247"}   
  
  Match data {:match=&gt;{"message"=&gt;"%{IP:client} %{TIMESTAMP_ISO8601:timestamp} \"%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} %{NUMBER:responsesize} \"%{DATA:referer}\" \"%{DATA:useragent}\" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}"}, :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"254"}   
  
  Grok compile {:field=&gt;"message", :patterns=&gt;["%{IP:client} %{TIMESTAMP_ISO8601:timestamp} \"%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} %{NUMBER:responsesize} \"%{DATA:referer}\" \"%{DATA:useragent}\" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}"], :level=&gt;:info, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"265"}   
  
  regexp: apachecombined/message {:pattern=&gt;"%{IP:client} %{TIMESTAMP_ISO8601:timestamp} \"%{WORD:verb} %{URIPROTO}://%{URIHOST:project}%{URIPATHPARAM} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status} %{NUMBER:responsesize} \"%{DATA:referer}\" \"%{DATA:useragent}\" %{NUMBER:time_till_first_byte} %{WORD:hit_miss}", :level=&gt;:debug, :file=&gt;"logstash/filters/grok.rb", :line=&gt;"267"}   
  
  Pipeline started {:level=&gt;:info, :file=&gt;"logstash/pipeline.rb", :line=&gt;"78"}   
  
  _discover_file_glob: /var/log/varnish/varnish.log: glob is: [] {:level=&gt;:debug, :file=&gt;"filewatch/watch.rb", :line=&gt;"117"}   
  
  _discover_file_glob: /var/log/varnish/varnish.log: glob is: [] {:level=&gt;:debug, :file=&gt;"filewatch/watch.rb", :line=&gt;"117"}   
  
  _discover_file_glob: /var/log/varnish/varnish.log: glob is: [] {:level=&gt;:debug, :file=&gt;"filewatch/watch.rb", :line=&gt;"117"}   
  
  _discover_file_glob: /var/log/varnish/varnish.log: glob is: [] {:level=&gt;:debug, :file=&gt;"filewatch/watch.rb", :line=&gt;"117"}
  </code></pre>