#logstash

hiya good people, i was having a 5.6 single-node ELK stack setup, running and working beautifully - but noticed 6.x was released in apt-repo.. so upgraded but im facing a few issues i can seem to nail - hope someone here have a moment?

i have a single locally deployed file in /etc/logstash/conf.d/zyxel.conf along with a set of patterns in a file residing in /usr/share/logstash/patterns. It seems though, that the config-update poller is running crazy heavy duty, cuz it sends out around 750 debug-loglines a second about 'skipping files - not matching specified glob pattern'

im seeing monitoring metrics through kibana / es about the node but zero output events triggers from logstash (file input) to es (elasticsearch output). anyone have an idea to hint me in the right direction?

oh.. seems coupled to path.config in logstash.yml; i defined as the folder /etc/logstash/conf.d which resultet in the endless loop. tried leaving the path.config undefined - resulting in endlessly looping 'read pipelines.yml -> module load, read pipelines.yml -> module load etcetc'

yet.. even if logstash does not spam logfile, it utilizes 95% cpu (leaving little to kibana and es :)

i cannot use config.reload anymore or worker-threads (iterating PIDs) will eat CPU in endless loop fashion. first info i inform u about, the 'globbed files' spams seems to origin from the mentioned endless loop - if no files under LS_PATH_CONF (the etc-folder) matches the glob defined in path.config (logstash.yml)

also, file-input plugin ignores the start_pos: begin option :( bedtime, will leave irc open over night, let me know if u need details