Elastic Engineer 1 Lab 1.4 Blog Data Indexing Problem

Hello Elastic Training Support,

I was working through Lab 1.4 and made it to step 3 before encountering a problem with indexing the required data. Upon issuing the following command:

./logstash-7.8.0/bin/logstash -f datasets/blogs_sql.conf

I was given the following output:

The last error keeps repeating indefinitely and I hit Control + C to get out of the loop. In the hope that some of the documents were indexed before the error, I issued the following command:

GET blogs/_search

And was returned the following:

Screen Shot 2021-03-22 at 2.56.48 PM

If you can give me some guidance for how to resolve this issue that would be excellent. Thanks for your time :wink:

Hi Mark Allen

thank you for reaching out to us and apologies that you run into issues with the labs.

I'm not quite sure what went wrong in the first place, but the second one is easy to explain. You need to distinguish between the commands to be executed on the command line (usually rendered as code blocks with a black background) vs. commands to be submitted from the Kibana Dev Console (typically rendered with a white background).

For the "GET" command simply go to the Kibana Dev Console and submit the very same command from there and you should see the response in the right pane.

Let me know if this worked and how many hits you got, because it's also clear from your screenshot that Logstash managed to index some documents.

Regards, Daniel

Ahh... You are right, I should have remembered that from the previous labs. Good deal, I'll check that again next time I log in to fire up the lab.

I'm curious if anyone knows what's going on with that first error though...


Hello Mark,

The first error suggests that elasticsearch is not currently running.

You can see in the logs that Logstash effectively collected data (each dot represents a document collected by Logstash). However, Logstash is trying to reach elasticsearch but fails to do so.

Make sure that your ES instance is running first before starting Logstash.


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.