logstash simple file input/output

ignore_older => 0 did the trick, see documentaion: ignore_older.

The working configuration is the following:

# foo.conf
input {
    file {
        path => "C:/logstash-2.3.1/logstash-tutorial-dataset"
        start_position => "beginning"
        ignore_older => 0  
    }
}
output {
    stdout {}
    file {
        path => "C:/output.txt"
    }
}

Now the .sincedb* file contains as well content.

Logstash remembers which files it has processed, and how much of them it has processed. In normal operations, this allows it to restart in case of failure and not reprocess logs.

In your case, I imagine that your log file has been processed once already, so logstash is ignoring it. The "start_position" parameter you've provided is documented to only apply to new files.

You would either need to reset your registry (perhaps files like /var/lib/logstash/.sincedb*), or set the "sincedb_path" parameter in your file{} into to /dev/null so that it doesn't maintain the history while you're testing.