Logstash File Input sincedb_path vs. Docker Read‑Only Filesystem: Unresolved Path Resolution

Answer to the Core Questions

1. What base directory does Logstash use to resolve a relative sincedb_path when running inside a container?
Logstash resolves a relative sincedb_path against the container’s current working directory (CWD). The CWD is set by the WORKDIR directive in the Dockerfile (defaulting to /usr/share/logstash) or by the -w flag passed to docker run.

2. How can we reliably configure sincedb_path to avoid duplicate events in a read‑only environment?
Use an absolute path that points to a writable volume mounted into the container. For example:

input {
  file {
    path => "/var/log/app/*.log"
    sincedb_path => "/var/lib/logstash/sincedb"
  }
}

Mount /var/lib/logstash from the host (e.g., docker run -v /opt/logstash-sincedb:/var/lib/logstash) and ensure the directory is owned by the logstash user (UID 1000 by default).

3. Does Logstash provide a configuration option to override the default relative path resolution?
No. The plugin does not expose a separate key for changing the base directory. The only supported method is to supply an absolute path.

Confirmed Behavior

• When the CWD is writable, Logstash creates the sincedb file there.
• If the CWD is read‑only or missing, Logstash falls back to /tmp or fails silently; this can lead to duplicate or missing events after restarts.
• Relative paths are resolved at container start‑up, before any pipeline configuration is loaded.

Practical Steps to Avoid Duplicates

1. Identify the container’s CWD.
   

   docker exec <container> sh -c 'echo $PWD'
   

2. Create a writable directory on the host.
   

   mkdir -p /opt/logstash-sincedb
   chown 1000:1000 /opt/logstash-sincedb
   

3. Mount the directory into the container.
   

   docker run -d \
     -v /opt/logstash-sincedb:/var/lib/logstash \
     -v /var/log/app:/var/log/app \
     --name logstash my-logstash-image
   

4. Configure sincedb_path absolutely in the pipeline.
5. Verify the file is created.
   

   docker exec <container> ls -l /var/lib/logstash/sincedb
   

6. Check Logstash debug output.
   

   docker exec <container> logstash -f /usr/share/logstash/pipeline.conf -v | grep sincedb
   

What to Verify

• After a container restart, confirm that the same sincedb file is reused and no duplicate events appear.
• If the CWD is overridden at runtime (e.g., docker run -w /app), verify that the relative path still resolves to the intended directory.
• Check file ownership and permissions inside the container: ls -l /var/lib/logstash should show UID 1000.

When to Ask for More Detail

If you are still observing duplicates after following the steps above, confirm whether the container’s WORKDIR is being overridden at runtime. The recommendation to use an absolute sincedb_path remains valid regardless of that detail.