Does anyone know why logstash is only inserting a few fields and no data into Elasticsearch?

Elastic Stack Elasticsearch
1

Hi,
I am using the latest versions of Logstash and a 4 node Elasticsearch cluster. I recently attended the ELK training in Manchester and my new Logstash setup happily puts data into my test single node Elasticsearch that I used in the class. The test Logstash from the class has the same problem as my new setup.

The two are communicating because for every line of log, ES creates 4 fields of data similar to the following.

t_id AU5KK3Y5gZuFz7FSXM7q
t_index logstash-2015.07.01
t_source {}
t_type logs

The only thing I can think of that are a bit different are that the 4 nodes have been upgraded through several versions of ES, We also have the couchbase plugin installed and we have at least one of our indexes locked so that they mapping cannot be changed.

Any suggestions on how to sort this one out would be gratefully appreciated as my forehead is getting very sore now.

Thanks in advance,

Carl

2

Looks like an empty event is being inserted. What does your Logstash config and mappings for the logstash-2015.07.01 look like?

3

Hi Christian,

Thanks for your reply, the most basic attempt I have tried is
input {
stdin {}
}

filter {}

output {

Elasticsearch via HTTP REST

elasticsearch {
host => "192.168.1.52"
protocol => "http"
}
stdout { codec => rubydebug }
}

This happily pushed data into my single node test ES, but with only a change of IP address to various of the 4 nodes failed.

The following is the mapping from the cluster, automatically created by logstash I believe.

{
"logstash-2015.07.01" : {
"aliases" : {
},
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string"
},
"match" : "message",
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "",
"match_mapping_type" : "string"
}
}
],
"_all" : {
"enabled" : true,
"omit_norms" : true
},
"_source" : {
"includes" : [
"meta."
]
},
"properties" : {
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"meta" : {
"type" : "object",
"include_in_all" : false
}
}
},
"logs" : {
"dynamic_templates" : [
{
"message_field" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string"
},
"match" : "message",
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "",
"match_mapping_type" : "string"
}
}
],
"_all" : {
"enabled" : true,
"omit_norms" : true
},
"_source" : {
"includes" : [
"meta."
]
},
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"host" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"message" : {
"type" : "string",
"norms" : {
"enabled" : false
}
},
"meta" : {
"type" : "object",
"include_in_all" : false
},
"tags" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"useragent" : {
"properties" : {
"device" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"name" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"os" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"os_name" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
}
}
}
}
},
"couchbaseCheckpoint" : {
"dynamic_templates" : [
{
"store_no_index" : {
"mapping" : {
"include_in_all" : false,
"index" : "no",
"store" : "no"
},
"match" : ""
}
},
{
"message_field" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string"
},
"match" : "message",
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "",
"match_mapping_type" : "string"
}
}
],
"_all" : {
"enabled" : true,
"omit_norms" : true
},
"_source" : {
"includes" : [
"meta.",
"doc."
]
},
"properties" : {
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"doc" : {
"include_in_all" : false,
"properties" : {
"uuid" : {
"type" : "string",
"index" : "no",
"include_in_all" : false
}
}
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"meta" : {
"type" : "object",
"include_in_all" : false
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1435762267716",
"uuid" : "UL3VPr5sTomBWt_KBS0RqA",
"number_of_replicas" : "1",
"number_of_shards" : "5",
"refresh_interval" : "5s",
"version" : {
"created" : "1060099"
}
}
},
"warmers" : {
}
}
}