# Does anyone know why logstash is only inserting a few fields and no data into Elasticsearch?

**URL:** <https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749>\
**Category:** Elasticsearch\
**Created:** [July 1, 2015, 5:58pm UTC](https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749 "2015-07-01T17:58:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adepteo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adepteo/32/3543_2.png) [@adepteo](https://discuss.elastic.co/u/adepteo)\
**Post date:** [July 1, 2015, 5:58pm UTC](https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749/1 "2015-07-01T17:58:25Z")

</div>

Hi,  
I am using the latest versions of Logstash and a 4 node Elasticsearch cluster. I recently attended the ELK training in Manchester and my new Logstash setup happily puts data into my test single node Elasticsearch that I used in the class. The test Logstash from the class has the same problem as my new setup.

The two are communicating because for every line of log, ES creates 4 fields of data similar to the following.

t\_id AU5KK3Y5gZuFz7FSXM7q  
t\_index logstash-2015.07.01  
t\_source {}  
t\_type logs

The only thing I can think of that are a bit different are that the 4 nodes have been upgraded through several versions of ES, We also have the couchbase plugin installed and we have at least one of our indexes locked so that they mapping cannot be changed.

Any suggestions on how to sort this one out would be gratefully appreciated as my forehead is getting very sore now.

Thanks in advance,

Carl

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 1, 2015, 6:48pm UTC](https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749/2 "2015-07-01T18:48:29Z")

</div>

Looks like an empty event is being inserted. What does your Logstash config and mappings for the logstash-2015.07.01 look like?

---

<div class="post-metadata">

**Author:** ![adepteo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adepteo/32/3543_2.png) [@adepteo](https://discuss.elastic.co/u/adepteo)\
**Post date:** [July 1, 2015, 7:40pm UTC](https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749/3 "2015-07-01T19:40:26Z")

</div>

Hi Christian,

Thanks for your reply, the most basic attempt I have tried is  
input {  
stdin {}  
}

filter {}

output {

# Elasticsearch via HTTP REST

elasticsearch {  
host =\> "192.168.1.52"  
protocol =\> "http"  
}  
stdout { codec =\> rubydebug }  
}

This happily pushed data into my single node test ES, but with only a change of IP address to various of the 4 nodes failed.

The following is the mapping from the cluster, automatically created by logstash I believe.

{  
"logstash-2015.07.01" : {  
"aliases" : {  
},  
"mappings" : {  
"_default_" : {  
"dynamic\_templates" : [  
{  
"message\_field" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string"  
},  
"match" : "message",  
"match\_mapping\_type" : "string"  
}  
},  
{  
"string\_fields" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string",  
"fields" : {  
"raw" : {  
"index" : "not\_analyzed",  
"ignore\_above" : 256,  
"type" : "string"  
}  
}  
},  
"match" : "_",  
"match\_mapping\_type" : "string"  
}  
}  
],  
"\_all" : {  
"enabled" : true,  
"omit\_norms" : true  
},  
"\_source" : {  
"includes" : [  
"meta._"  
]  
},  
"properties" : {  
"@version" : {  
"type" : "string",  
"index" : "not\_analyzed"  
},  
"geoip" : {  
"dynamic" : "true",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
}  
},  
"meta" : {  
"type" : "object",  
"include\_in\_all" : false  
}  
}  
},  
"logs" : {  
"dynamic\_templates" : [  
{  
"message\_field" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string"  
},  
"match" : "message",  
"match\_mapping\_type" : "string"  
}  
},  
{  
"string\_fields" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string",  
"fields" : {  
"raw" : {  
"index" : "not\_analyzed",  
"ignore\_above" : 256,  
"type" : "string"  
}  
}  
},  
"match" : "_",  
"match\_mapping\_type" : "string"  
}  
}  
],  
"\_all" : {  
"enabled" : true,  
"omit\_norms" : true  
},  
"\_source" : {  
"includes" : [  
"meta._"  
]  
},  
"properties" : {  
"@timestamp" : {  
"type" : "date",  
"format" : "dateOptionalTime"  
},  
"@version" : {  
"type" : "string",  
"index" : "not\_analyzed"  
},  
"geoip" : {  
"dynamic" : "true",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
}  
},  
"host" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},  
"message" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
}  
},  
"meta" : {  
"type" : "object",  
"include\_in\_all" : false  
},  
"tags" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},  
"useragent" : {  
"properties" : {  
"device" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},  
"name" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},  
"os" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
},  
"os\_name" : {  
"type" : "string",  
"norms" : {  
"enabled" : false  
},  
"fields" : {  
"raw" : {  
"type" : "string",  
"index" : "not\_analyzed",  
"ignore\_above" : 256  
}  
}  
}  
}  
}  
}  
},  
"couchbaseCheckpoint" : {  
"dynamic\_templates" : [  
{  
"store\_no\_index" : {  
"mapping" : {  
"include\_in\_all" : false,  
"index" : "no",  
"store" : "no"  
},  
"match" : "_"  
}  
},  
{  
"message\_field" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string"  
},  
"match" : "message",  
"match\_mapping\_type" : "string"  
}  
},  
{  
"string\_fields" : {  
"mapping" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string",  
"fields" : {  
"raw" : {  
"index" : "not\_analyzed",  
"ignore\_above" : 256,  
"type" : "string"  
}  
}  
},  
"match" : "_",  
"match\_mapping\_type" : "string"  
}  
}  
],  
"\_all" : {  
"enabled" : true,  
"omit\_norms" : true  
},  
"\_source" : {  
"includes" : [  
"meta._",  
"doc._"  
]  
},  
"properties" : {  
"@version" : {  
"type" : "string",  
"index" : "not\_analyzed"  
},  
"doc" : {  
"include\_in\_all" : false,  
"properties" : {  
"uuid" : {  
"type" : "string",  
"index" : "no",  
"include\_in\_all" : false  
}  
}  
},  
"geoip" : {  
"dynamic" : "true",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
}  
},  
"meta" : {  
"type" : "object",  
"include\_in\_all" : false  
}  
}  
}  
},  
"settings" : {  
"index" : {  
"creation\_date" : "1435762267716",  
"uuid" : "UL3VPr5sTomBWt\_KBS0RqA",  
"number\_of\_replicas" : "1",  
"number\_of\_shards" : "5",  
"refresh\_interval" : "5s",  
"version" : {  
"created" : "1060099"  
}  
}  
},  
"warmers" : {  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:04am UTC](https://discuss.elastic.co/t/does-anyone-know-why-logstash-is-only-inserting-a-few-fields-and-no-data-into-elasticsearch/24749/4 "2017-07-06T00:04:06Z")

</div>