# Config file won't stash a log **URL:** \ **Category:** Logstash\ **Created:** [January 8, 2017, 1:32pm UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876 "2017-01-08T13:32:15Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![HeatherB](https://avatars.discourse-cdn.com/v4/letter/h/dec6dc/32.png) [@HeatherB](https://discuss.elastic.co/u/HeatherB)\ **Post date:** [January 8, 2017, 1:32pm UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/1 "2017-01-08T13:32:15Z")
Hi:) I'm very new to logstash and elasticsearch, I am trying to stash my first log to log stash in a way that I can (correct me if it is not the purpose) search it using elasticsearch.... I have a log that looks like this basically: > 2016-12-18 10:16:55,404 - INFO - flowManager.py - loading metadata xml So, I have created a config file test.conf that looks like this: ``` input { file { path => "/home/usr/tmp/logs/mylog.log" type => "test-type" id => "NEWTRY" } } filter { grok { match => { "message" => "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} - %{LOGLEVEL:level} - %{WORD:scriptName}.%{WORD:scriptEND} - " } } } output { elasticsearch { hosts => ["localhost:9200"] index => "ecommerce" codec => line { format => "%{year}-%{month}-%{day} %{hour}:%{minute}:%{second} - %{level} - %{scriptName}.%{scriptEND} - \"%{message}\"" } } } ``` And then : `./bin/logstash -f test.conf` I do not see the log in Elasticsearch when I go to: `http://localhost:9200/ecommerce` or to `http://localhost:9200/ecommerce/test-type/NEWTRY` Please tell me what am I doing wrong.... 😕 Thanks, Heather ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 8, 2017, 11:38pm UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/2 "2017-01-08T23:38:34Z")
Add a stdout and see if there is anything in the output. If not, then its sincedb 🙂 ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [January 9, 2017, 12:00am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/3 "2017-01-09T00:00:27Z")
Since your doing it from the CLI, in your directory it will write a .sincedb\_XXXXXXX file The File input remembers the last time it has read a file and it would be stored in that file. if your testing you can set the option to the file in put called sincedb\_path=\>/dev/null but only do this for testing files. Or you can jut delete the .sincedb\_XXXXXX files. other then that I see no reason it not working ---
**Author:** ![HeatherB](https://avatars.discourse-cdn.com/v4/letter/h/dec6dc/32.png) [@HeatherB](https://discuss.elastic.co/u/HeatherB)\ **Post date:** [January 9, 2017, 7:43am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/4 "2017-01-09T07:43:49Z")
I tried to do both no change in results... I'm suppose to see it when I go to `http://localhost:9200/ecommerce/` right? Or am I checking in the wrong place...? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 9, 2017, 7:44am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/5 "2017-01-09T07:44:29Z")
> [@HeatherB](#): > > I tried to do both no change in results... So what do you see in the console then? ---
**Author:** ![HeatherB](https://avatars.discourse-cdn.com/v4/letter/h/dec6dc/32.png) [@HeatherB](https://discuss.elastic.co/u/HeatherB)\ **Post date:** [January 9, 2017, 8:04am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/6 "2017-01-09T08:04:54Z")
I see that it has run health check, and then a warning that connections to ES instance has restored...[https://drive.google.com/open?id=0BwAfQjh0z4O8ZmJTSktpem5LS3c](https://drive.google.com/open?id=0BwAfQjh0z4O8ZmJTSktpem5LS3c) When I use the debug level I see some fatal error related to the patterns adding like `Adding pattern {"BACULA_LOG_MAXSTART"=>"Fatal error: Job canceled because max start delay time exceeded."}` [https://drive.google.com/open?id=0BwAfQjh0z4O8VmdRZnI1cXdXZmM](https://drive.google.com/open?id=0BwAfQjh0z4O8VmdRZnI1cXdXZmM) .. But I have checked the patterns in the grok debugger and it seemed okay... ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 9, 2017, 8:06am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/7 "2017-01-09T08:06:17Z")
It may also be [https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-start\_position](https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-start_position) ---
**Author:** ![HeatherB](https://avatars.discourse-cdn.com/v4/letter/h/dec6dc/32.png) [@HeatherB](https://discuss.elastic.co/u/HeatherB)\ **Post date:** [January 9, 2017, 8:28am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/8 "2017-01-09T08:28:39Z")
OMG it has worked!! THANK YOU SO MUCH!! 😀 😀 😀 Do you know maybe why was it required...? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 9, 2017, 8:29am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/9 "2017-01-09T08:29:31Z")
Because the default is `end` 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2017, 8:29am UTC](https://discuss.elastic.co/t/config-file-wont-stash-a-log/70876/10 "2017-02-06T08:29:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.