Quit logstash forwarder on EOF

[mieciu]

At first I thought about additional parameter in the config file, something which could work like this: mieciu@2def88f

But then I had realized that a CMD option would be more elegant and comfortable.

At the company I'm working for we had to recover our ELK instance by pushing several log files with logstash-forwarder back to logstash instances. Of course we've set the config to catch STDIN and piped the logfile to the program. It would be perfect to provide logstash-forwarder such a feature, so that after displaying " FIle truncated...." it would exit immediately.

[oppianmatt]

Yep, this just bit me too. Had it to capture cron jobs outputs overnight, but the processes never end. Feels like if it's accepting stdin it should quit when it gets a eof. No point seeking to beginning of stdin when it's finished.

[rnavarr]

There is indeed a bug in logstash-forwarder. Piping input into its STDIN (with "paths": [ "-" ] set) should end gracefully when the stdin ends. Instead /var/log/messages says:
2015/01/09 01:37:28.196532 File truncated, seeking to beginning: -

and the following hangs forever:
print '' | /opt/logstash-forwarder/bin/logstash-forwarder -config logstash-fwd-mysql-slowquery.conf

I suspect the code is treating a pipe like a file and trying to seek on it. Pipes cannot be seeked on. They can be endless and data is gone once read out (by logstash-forwarder).
R