# All Running but not Parsing or sending to Elasticsearch

**URL:** <https://discuss.elastic.co/t/all-running-but-not-parsing-or-sending-to-elasticsearch/145894>\
**Category:** Logstash\
**Created:** [August 24, 2018, 11:00am UTC](https://discuss.elastic.co/t/all-running-but-not-parsing-or-sending-to-elasticsearch/145894 "2018-08-24T11:00:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![LloydA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lloyda/32/34788_2.png) [@LloydA](https://discuss.elastic.co/u/LloydA)\
**Post date:** [August 24, 2018, 11:00am UTC](https://discuss.elastic.co/t/all-running-but-not-parsing-or-sending-to-elasticsearch/145894/1 "2018-08-24T11:00:33Z")

</div>

Hi All.

I've set up an Logstash and Elasticsearch on a DigitalOcean Droplet. I am looking to index a CSV file in Elasticsearch by putting it through Logstash. Just to get it running, I'm using `GREEDYDATA` for my `grok` parsing. It has been tested and works. Here's where I'm at:

My Logstash `conf.d` file is as follows:

```auto
    input {
      file {
        start_position => "beginning"
        path => "/usr/airtime.csv"
      }
    }
    
    filter {
      grok {
        match => { "message" => "\"%{GREEDYDATA:Timestamp}\"\,%{GREEDYDATA:Network}\,% {GREEDYDATA:Amount}\,%{GREEDYDATA:MobilePhoneContactNumber}\,%{GREEDYDATA:VoucherPIN$" }
        add_field => ["received_at", "%{@timestamp}"]
        add_field => ["received_from", "%{host}"]
      }
    }
  
    output {
      elasticsearch { hosts => ["localhost:9200"] }
      stdout { codec => "dots" }
      if "_grokparsefailure" in [tags]{
        stdout { codec => "rubydebug" }
      }
    }

```

My Elasticsearch is set to `0.0.0.0` and port `9200`. I run Logstash using the following command from within `/bin`:

`./logstash -f /etc/logstash/conf.d/logstash-simple.conf`

The run is attached as a picture in order to minimize the size of this post. It runs completely to the point where it waits for input from the user (the red line in the image). I've waited for 10 minutes. At this point I press Ctrl-C. No Indexing/parsing is done and Elasticsearch remains empty. No errors in the logstash or elasticsearch logs.

I'm not sure what to do at this point. If you need any further info, please do not hesitate to ask. Any further help will be greatly appreciated.

Thank You!

 ![Logstash](https://us1.discourse-cdn.com/elastic/original/3X/6/2/62f169ef6d22c67204d40a18c47d0f536da321e3.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 27, 2018, 8:16pm UTC](https://discuss.elastic.co/t/all-running-but-not-parsing-or-sending-to-elasticsearch/145894/2 "2018-08-27T20:16:15Z")

</div>

Logstash has probably processed the file before so it doesn't process it again. `start_position => "beginning"` only matters for previously unseen files. See what the file input documentation says about sincedb and check out the countless previous posts on this topic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2018, 8:16pm UTC](https://discuss.elastic.co/t/all-running-but-not-parsing-or-sending-to-elasticsearch/145894/3 "2018-09-24T20:16:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.