{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/38","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/38/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/38/events","html_url":"https://github.com/logstash-plugins/logstash-input-file/issues/38","id":77506178,"number":38,"title":"File input appears to stop reading from NFS when rsyncing files","user":{"login":"jordansissel","id":131818,"avatar_url":"https://avatars.githubusercontent.com/u/131818?v=3","gravatar_id":"","url":"https://api.github.com/users/jordansissel","html_url":"https://github.com/jordansissel","followers_url":"https://api.github.com/users/jordansissel/followers","following_url":"https://api.github.com/users/jordansissel/following{/other_user}","gists_url":"https://api.github.com/users/jordansissel/gists{/gist_id}","starred_url":"https://api.github.com/users/jordansissel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordansissel/subscriptions","organizations_url":"https://api.github.com/users/jordansissel/orgs","repos_url":"https://api.github.com/users/jordansissel/repos","events_url":"https://api.github.com/users/jordansissel/events{/privacy}","received_events_url":"https://api.github.com/users/jordansissel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-18T05:20:40Z","updated_at":"2015-11-06T13:37:53Z","closed_at":null,"body":"(This issue was originally filed by @ScottChapman at https://github.com/elastic/logstash/issues/2803)\n\n---\n\nSo, I have a file input clause, and logstash is actively reading files from an NFS share.\r\n\r\nThen rsync comes along and updates files, and my logstash just stops.\r\n\r\nI've watched the files that are getting updated, and no new files, and no inode changes. Just a log file increases in size.\r\n\r\nI can do a tail -f on the file and that runs just fine which rsync-ing.\r\n\r\nAny ideas?"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/comments/154411416","html_url":"https://github.com/logstash-plugins/logstash-input-file/issues/38#issuecomment-154411416","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-input-file/issues/38","id":154411416,"user":{"login":"raphaele81","id":10754469,"avatar_url":"https://avatars.githubusercontent.com/u/10754469?v=3","gravatar_id":"","url":"https://api.github.com/users/raphaele81","html_url":"https://github.com/raphaele81","followers_url":"https://api.github.com/users/raphaele81/followers","following_url":"https://api.github.com/users/raphaele81/following{/other_user}","gists_url":"https://api.github.com/users/raphaele81/gists{/gist_id}","starred_url":"https://api.github.com/users/raphaele81/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphaele81/subscriptions","organizations_url":"https://api.github.com/users/raphaele81/orgs","repos_url":"https://api.github.com/users/raphaele81/repos","events_url":"https://api.github.com/users/raphaele81/events{/privacy}","received_events_url":"https://api.github.com/users/raphaele81/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T13:37:53Z","updated_at":"2015-11-06T13:37:53Z","body":"I have a similar issue with logstash-2.0.0 running on windows server 2012 :\r\n\r\nI have log files being written asynchronously by a java program on one server. Logstash reads those files via a shared folder.\r\nOn start up, everything works fine, but then, logstash stops reading the files even though they are being updated.  When i restart logstash it reads the latest entries and then stops again.\r\n\r\nI first thought it was a caching problem, however, when I put logstash in debug mode, after the last line being read, I have logstash log entries showing that it sees the files has changed:\r\n```\r\n{:timestamp=>\"2015-11-06T11:12:24.478000+0100\", :message=>\"//path/to/my/log/trace_20151106.log: file grew, old size 352281, new size 352427\", :level=>:debug, :file=>\"/elk/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.5/lib/filewatch/watch.rb\", :line=>\"96\", :method=>\"each\"}\r\n```\r\n\r\nI also realized that when the problem occurs, the last line of the logs file is full af ascii 'NUL' characters. When i stop logstash the 'NUL' line disappear. So I might be coming across the problem discribed here : https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918\r\n\r\nWe can't launch our ELK stack in production if this problem isn't fixed.\r\n"}}