我有一个问题，我不能弄清楚。我也不知道如何logstashsincedb_path工作太多，所以如果有人能帮助我理解-我会非常感激。
我在RedHat Linux虚拟机上运行ELK。如果我在终端中运行logstash文件：

sudo /usr/share/logstash/bin/logstash  -f /etc/logstash/conf.d/new.conf

一切工作，我甚至看到日志在kibana这是可怕的btw。
但是，如果我尝试将其作为服务运行，则所有操作都将在此处停止，并显示信息日志记录选项：

[2022-10-11T22:42:26,668][INFO ][filewatch.observingtail  ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] START, creating Discoverer, Watch with file and sincedb collections
[2022-10-11T22:42:26,681][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

跟踪日志记录选项显示：

[2022-10-11T23:16:07,000][TRACE][filewatch.discoverer     ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:07,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:08,001][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:08 +0300)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] non_atomic_write:  {:time=>2022-10-11 23:16:08 +0300}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:12,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:17,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:22,005][TRACE][filewatch.discoverer     ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:22,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:23,006][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:23,006][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:23 +0300)

我猜这意味着它找不到我的json文件。还有**writing sincedb（delta since last write = 15）**值没有改变。
new.conf:

input {
file {
path => "/home/mariussur/logstash/c.json"
codec => "json"
sincedb_path => "/dev/null"
start_position => "beginning"
}
}

filter {}

output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://***.**.*.**:9200/"]
user => "*******"
password => "*******"
index => "some-tag"
action => "create"
}
}

pipelines.yml:

- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

我试过将文件的所有权更改为logstash用户，但仍然没有运气。也许有人有类似的问题，可以帮助我解决。
先谢谢你。
M的。