# Data not sent to ElasticSearch (with Logstash)

**URL:** https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696
**Category:** Logstash
**Created:** [December 22, 2021, 2:22pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696 "2021-12-22T14:22:47Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Greninja\_San](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/greninja_san/32/96119_2.png) [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)
#### Post date: [December 22, 2021, 2:22pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/1 "2021-12-22T14:22:47Z")

</div>

Hello! I'm trying to send data to Elasticsearch with logstash on a Linux server. For some reasons, I do not get any error, but nothing is sent.

```auto
input {
  file {
    path => ["/srv/XXX/csv_receivers/XXX_receiver/*"]
    ignore_older => 10000000000
    start_position => "beginning"
    sincedb_path => "NUL"
    codec => plain {
      charset => "ANSI_X3.4-1968"
    }
  }
}

filter {
     csv {
        separator => ";"
        columns => ["sender", "receiver", "flow_type", "start_traitement", "end_traitement", "start_size", "end_size", "start_format", "end_format", "start_platform", "end_platform", "start_transport", "end_transport", "prod"]
     }
    date {
    match => ["start_traitement", "dd/MM/yy HH:mm:ss,SSS000000"]
    target => "start_traitement_true"
    }
    date {
    match => ["end_traitement", "dd/MM/yy HH:mm:ss,SSS000000"]
    target => "end_traitement_true"
    }
    ruby {
    code => 'event.set("date_epoch_end", event.get("end_traitement_true").to_i)'
    }
    ruby {
    code => 'event.set("date_epoch_start", event.get("start_traitement_true").to_i)'
    }
    ruby {
    code => 'event.set("time_between", (event.get("date_epoch_end"))-(event.get("date_epoch_start")))'
    }
    ruby {
    code => 'event.set("fixedProd", (event.get("prod")).tr("\r", ""))'
    }

    ruby {
    code => 'event.set("cat", "XXX")'
    }

    mutate {
      convert => {
         "sender" => "string"
         "receiver" => "string"
         "flow_type" => "string"
         "start_size" => "integer"
         "end_size" => "integer"
         "start_format" => "string"
         "end_format" => "string"
         "start_platform" => "string"
         "end_platform" => "string"
         "date_epoch_end" => "float"
         "date_epoch_start" => "float"
         "start_transport" => "string"
         "end_transport" => "string"
         "prod" => string
         }
    }

    prune{
      blacklist_names => ["message"]
    }

}

output {
  elasticsearch {
    hosts => "XXXXXXXXX:9200"
    index => "testindex"
    user => "elastic"
    password => "XXXXXXXX"
  }
}

```

Thanks for the help! \<3

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [December 22, 2021, 2:36pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/2 "2021-12-22T14:36:54Z")

</div>

What happens if you put a stdout output? What do you see?

```auto
output {
   stdout{}
}

```

---

<div class="post-metadata">

### Author: ![Greninja\_San](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/greninja_san/32/96119_2.png) [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)
#### Post date: [December 22, 2021, 2:39pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/3 "2021-12-22T14:39:55Z")

</div>

Nothing. But it might be caused by the fact that logstash is here used as a service (with systemctl).

---

<div class="post-metadata">

### Author: ![Greninja\_San](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/greninja_san/32/96119_2.png) [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)
#### Post date: [December 22, 2021, 2:51pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/5 "2021-12-22T14:51:27Z")

</div>

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0c9c9694bebc0a6a4a0330234e7728620950970b.png)

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [December 22, 2021, 4:05pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/7 "2021-12-22T16:05:11Z")

</div>

Then start the process manually.  
`/usr/share/logstash/bin/logstash -f <path to config file>`

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 22, 2021, 5:17pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/8 "2021-12-22T17:17:23Z")

</div>

> [@Greninja\_San](#):
>
> `sincedb_path => "NUL"`

If you do not want to persist the in-memory sincedb across restarts then that is the correct setting on Windows. On UNIX it will persist the sincedb into a file called NUL in the working directory of the logstash process. Try

```
sincedb_path => "/dev/null"

```

---

<div class="post-metadata">

### Author: ![Greninja\_San](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/greninja_san/32/96119_2.png) [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)
#### Post date: [December 23, 2021, 2:03pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/9 "2021-12-23T14:03:22Z")

</div>

what was the previous message please?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 20, 2022, 2:03pm UTC](https://discuss.elastic.co/t/data-not-sent-to-elasticsearch-with-logstash/292696/10 "2022-01-20T14:03:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
