Can't get logstash read json files to insert into ES

Elastic Stack Logstash
1

I try to run a JSON file trough Logstash to index in Elasticsearch, but I can't seem to get it indexed. I don't get any error messages or anything. It says: "Logstash startup complete".

My .conf file is set up like this

input {
stdin { }
file {
     type => json
     path =>  ["/home/francop/Desktop/logstash/conf/Datos/*.json"]
     codec => json
     start_position => beginning
     }
}

output {
        elasticsearch { hosts => ["localhost:9200"] }
        stdout { codec => rubydebug }
}

And my JSON file got the data like this

 {"@timestamp":"2016-12-01T23:58:17.360-03:00","@version":1,"message":"transactionStmId: TEST201612012358176958 - llamada al CREATEDOCUMENT","logger_name":"com.enerminds.stm.event.service.impl.StmEventServiceImpl","thread_name":"main","level":"INFO","level_value":20000,"HOSTNAME":"I120053","event":"CREATEDOCUMENT","step":"entrada"}
 {"@timestamp":"2016-12-01T23:58:27.789-03:00","@version":1,"message":"transactionStmId: TEST201612012358176958 - org.apache.velocity.exception.MethodInvocationException: Invocation of method 'getList' in  class com.fdatalink.oms.data.InList threw exception class java.lang.RuntimeException : List cannot be null nor empty\r\n","logger_name":"com.enerminds.stm.event.service.impl.StmEventServiceImpl","thread_name":"main","level":"INFO","level_value":20000,"HOSTNAME":"I120053","event":"CREATEDOCUMENT","errorCode":"3003","step":"error"}
 {"@timestamp":"2016-12-01T23:58:27.797-03:00","@version":1,"message":"transactionStmId: TEST201612012358179773 - llamada al SETOWNERGROUP","logger_name":"com.enerminds.stm.event.service.impl.StmEventServiceImpl","thread_name":"main","level":"INFO","level_value":20000,"HOSTNAME":"I120053","event":"SETOWNERGROUP","errorCode":"3003","step":"entrada"}

I have also delete de sincedb files just in case. Before deleting them I check if there was any data and just 0 0 0 0 appears.

im running ES 2.4.3 and logstash 2.4.1

2

I'm using Ubuntu 16.04

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.