# ELK 7.1.1 with defaults - Logstash doesn't fill index **URL:** \ **Category:** Logstash\ **Created:** [June 19, 2019, 5:51am UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377 "2019-06-19T05:51:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Alexl](https://avatars.discourse-cdn.com/v4/letter/a/f05b48/32.png) [@Alexl](https://discuss.elastic.co/u/Alexl)\ **Post date:** [June 19, 2019, 5:51am UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377/1 "2019-06-19T05:51:38Z")
Hello all! I'm using Windows 10 x64. First, I'm running bin/elasticsearch from cmd. _[http://localhost:9200/\_cat/indices](http://localhost:9200/_cat/indices)_ says: > green open .kibana\_task\_manager LSRA1gP5TCevDafKx51ecQ 1 0 2 0 53.6kb 53.6kb > green open .kibana\_1 bfa6VzYmSby-BzJkFYcxoQ 1 0 4 1 23kb 23kb > when _[http://localhost:9200/\_cat/health](http://localhost:9200/_cat/health)_ says: > 1560922509 05:35:09 elasticsearch green 1 1 2 2 0 0 0 0 - 100.0% Then, I'm trying to use bin/logstash -f logstash.conf --verbose with result: > C:\l\>.\bin\logstash -f logstash.conf --verbose > OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. > WARNING: An illegal reflective access operation has occurred > WARNING: Illegal reflective access by org.jruby.runtime.encoding.EncodingService (file:/C:/l/logstash-core/lib/jars/jruby-complete-9.2.7.0.jar) to field java.io.Console.cs > WARNING: Please consider reporting this to the maintainers of org.jruby.runtime.encoding.EncodingService > WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations > WARNING: All illegal access operations will be denied in a future release > Sending Logstash logs to C:/l/logs which is now configured via log4j2.properties > [2019-06-18T22:34:15,431][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified > [2019-06-18T22:34:15,458][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.1"} > [2019-06-18T22:34:25,254][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://127.0.0.1:9200/](http://127.0.0.1:9200/)]}} > [2019-06-18T22:34:25,671][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://127.0.0.1:9200/](http://127.0.0.1:9200/)"} > [2019-06-18T22:34:26,285][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>7} > [2019-06-18T22:34:26,299][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7} > [2019-06-18T22:34:26,352][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[//127.0.0.1](https://127.0.0.1)"]} > [2019-06-18T22:34:26,375][INFO][logstash.outputs.elasticsearch] Using default mapping template > [2019-06-18T22:34:26,925][INFO][logstash.javapipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>250, :thread=\>"#\"} > [2019-06-18T22:34:26,970][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"index\_patterns"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s", "number\_of\_shards"=\>1}, "mappings"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}} > [2019-06-18T22:34:29,218][INFO][logstash.inputs.file] No sincedb\_path set, generating one based on the "path" setting {:sincedb\_path=\>"C:/l/data/plugins/inputs/file/.sincedb\_0668632417a0cfd5001d478541fc9478", :path=\>["C:\l\example.txt"]} > [2019-06-18T22:34:29,414][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=\>"main"} > [2019-06-18T22:34:29,710][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} > [2019-06-18T22:34:29,738][INFO][filewatch.observingtail] START, creating Discoverer, Watch with file and sincedb collections > [2019-06-18T22:34:33,847][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} example.txt content is: > 532452345 > 25234534 > 245234 logstash.conf settings are: > input { > file{ > path =\> "C:\l\example.txt" > start\_position =\> "beginning" > } > } > > filter { > grok{ > match =\> { "message" =\> "%{NUMBER:line\_content}" } > } > } > output { > elasticsearch { > index =\> "test" > } > } ELK configurations by default. After that, the _[http://localhost:9200/\_cat/indices](http://localhost:9200/_cat/indices)_ shows: > green open .kibana\_task\_manager LSRA1gP5TCevDafKx51ecQ 1 0 2 0 53.6kb 53.6kb > green open .kibana\_1 bfa6VzYmSby-BzJkFYcxoQ 1 0 4 1 23kb 23kb What happens? ---
**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Post date:** [June 19, 2019, 6:43am UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377/2 "2019-06-19T06:43:09Z")
> [@Alexl](#): > > output { > elasticsearch { > index =\> "test" > } > } Seems like you did not put in the hosts parameter, I don't think you are actually sending the document into elasticsearch. Try it with ` stdout { codec => rubydebug }` first. ``` output { #stdout { codec => rubydebug } elasticsearch { hosts => ["http://localhost:9200"] index => "test-%{+YYYY.MM.dd}" } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 19, 2019, 6:53am UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377/3 "2019-06-19T06:53:25Z")
Try using forward slash in the file path and see if that makes a difference. ---
**Author:** ![Alexl](https://avatars.discourse-cdn.com/v4/letter/a/f05b48/32.png) [@Alexl](https://discuss.elastic.co/u/Alexl)\ **Post date:** [June 26, 2019, 7:19pm UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377/4 "2019-06-26T19:19:45Z")
Input logstash configuration file was switched to this content: > input { > file{ > path =\> "C:/l/example.txt" > start\_position =\> "beginning" > } > } > output { > file { > path =\> "C:/l/output.txt" > } > } Logstash logs contains: > [2019-06-26T12:06:34,417][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > [2019-06-26T12:09:23,200][INFO][logstash.outputs.file] Opening file {:path=\>"C:/l/output.txt"} > [2019-06-26T12:09:37,750][INFO][logstash.outputs.file] Closing file C:/l/output.txt > [2019-06-26T12:10:04,148][INFO][logstash.outputs.file] Opening file {:path=\>"C:/l/output.txt"} > [2019-06-26T12:10:17,856][INFO][logstash.outputs.file] Closing file C:/l/output.txt > [2019-06-26T12:11:18,667][INFO][logstash.outputs.file] Opening file {:path=\>"C:/l/output.txt"} > [2019-06-26T12:11:38,129][INFO][logstash.outputs.file] Closing file C:/l/output.txt What ELK settings does control timeout between input file edit&save and it's opening by logstash? **Moved to [Logstash 7 timeout between input file modification and output file write control](https://discuss.elastic.co/t/logstash-7-timeout-between-input-file-modification-and-output-file-write-control/187664)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2019, 7:19pm UTC](https://discuss.elastic.co/t/elk-7-1-1-with-defaults-logstash-doesnt-fill-index/186377/5 "2019-07-24T19:19:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.