Logstash 默认不处理一天前的文件

The default behavior of the file input plugin is to ignore files whose last modification is 

greater than 86400s.

 To change this default behavior and process the tutorial file (which date can be much older than 

a day), we need to specify to not ignore old files.


input {
        file {
                type => "zj_nginx_access"
                path => ["/rsyslog/data/nginx/zjzc/nginx_access0*_log.*"]
                ignore_older => 87400
        }
    
       file { 
                type => "uat_nginx_access" 
                path => ["/rsyslog/data/nginx/uat/nginx_access0*_log.*"] 
                ignore_older => 87400 
        } 


文件输入插件的默认行为 是忽略那些文件 最后修改是大于86400s.


为了改变这个默认的行为和处理 文件(一天前的文件),我们可以指定不忽略老的文件