# Elastic search not updating

**URL:** <https://discuss.elastic.co/t/elastic-search-not-updating/61854>\
**Category:** Elasticsearch\
**Created:** [September 29, 2016, 8:09pm UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854 "2016-09-29T20:09:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JonnB](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@JonnB](https://discuss.elastic.co/u/JonnB)\
**Post date:** [September 29, 2016, 8:09pm UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854/1 "2016-09-29T20:09:18Z")

</div>

I have created an example I hope someone can assist with as previously versions of this worked, this is a cut down version with only a few fields as I cannot figure out what is different from this compared to past examples! Below are the steps I performed:

I created the mappings as follows, ran and no errors:

curl-XPUT [http://localhost:9200/analyzeme-d](http://localhost:9200/analyzeme-d) '  
{"mappings": { "_default_": {"date\_detection":false,"properties": {"mytext": {"type": "string", "index" :"not\_analyzed" },"mydate": {"type": "date","index" :"not\_analyzed" },"mynumber": { "type" : "integer" }}}}}';

Checked the settings, no errors:  
curl -XGET '[http://localhost:9200/analyzeme/\_settings](http://localhost:9200/analyzeme/_settings)'

Created a GROK script, no errors (at least from what I can see, location: /etc/logstash/conf.d/tc\_analyze.conf) - previous versions work fine

input  
{file{  
type=\> "testcase"  
path=\> '/usr/local/analyzeme/\*.log'  
sincedb\_path=\> "/usr/local/analyzeme/sincedb"  
start\_position=\> "beginning"  
}  
}

filter  
{  
grok  
{  
patterns\_dir=\> "/usr/local/sof-elk/grok-patterns"  
match=\> {"message"=\> "%{ANALYZEMELOG}"}}  
output  
{  
elasticsearch{  
index=\> "analyzeme"  
}  
}  
Imported some data, no errors:  
curl-XPOST 'localhost:9200/analyzeme/testcase/\_bulk?pretty'--data-binary @testcase.json

contents  
of the “testcase.json” file:

{"index":{"\_id":"2"}}  
{"mytext":"sometext","mydate":"2009-11-15T14:12:12","mynumber":0}

Started logstash using command, no apparent errors

/opt/logstash/bin/logstash -f /etc/logstash/conf.d/tc\_analyze.conf -vv –-debug

I then ran, which showed one document:

curl 'localhost:9200/\_cat/indices?v'

To confirm logstash is working I created the file /usr/local/analyzeme/test.log and typed a record, saved and re-ran:

curl 'localhost:9200/\_cat/indices?v'

The test showed a new document.

When I goto elasticsearch no data appears

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/acfc719cdf1a9612accc422c132a206c2483da20.png)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d37043d0a0ac31522db7a36e260a56c161e8212d.png)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/ad8f7b799adda34eebcd0004db5638d855e22b79.png)

Almost forgot: the grok pattern, which works in previous examples

ANALYZEMELOG "%{GREEDYDATA:sslurl}",%{TIMESTAMP\_ISO8601:sslscandate},%{NUMBER:ssldaysremaining}

The problem doesnt seem to be with logstash but with elasticsearch, thanks for any help!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 30, 2016, 5:23am UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854/2 "2016-09-30T05:23:47Z")

</div>

What does the output of `_cat/indices?v` show?

---

<div class="post-metadata">

**Author:** ![JonnB](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@JonnB](https://discuss.elastic.co/u/JonnB)\
**Post date:** [October 1, 2016, 4:24pm UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854/3 "2016-10-01T16:24:08Z")

</div>

Thanks for the reply, this is the output:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/226d85dcd202ce878919e4a77bec9b8b36b2f10e.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 1, 2016, 10:23pm UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854/4 "2016-10-01T22:23:39Z")

</div>

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:15pm UTC](https://discuss.elastic.co/t/elastic-search-not-updating/61854/5 "2017-07-05T22:15:35Z")

</div>