# ELK No Output

**URL:** <https://discuss.elastic.co/t/elk-no-output/46019>\
**Category:** Logstash\
**Created:** [April 1, 2016, 5:46am UTC](https://discuss.elastic.co/t/elk-no-output/46019 "2016-04-01T05:46:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [April 1, 2016, 5:46am UTC](https://discuss.elastic.co/t/elk-no-output/46019/1 "2016-04-01T05:46:08Z")

</div>

Hi,

I really hope somebody can help me.

I have installed ELK on CentOS 6.5 and even after reinstalling onto another box using a different howto, I still can't get Logstash to send me any output. I am supposed to get Logstash to log all HTTP POST requests. Just for the sake of getting it to work I have set it up to read from the Apache log files.

I keep on getting the message:  
"Waited for 30s and no initial state was set by the discovery".

## Versions:

Logstash 1.4.2  
Elasticsearch 1.4  
Kibana 4.0.0

## Logstash Conf:

input {

```
 file {
     type => "apache"
     path => ["/var/log/apache2/access.log", "/var/log/apache2/error.log"]
    sincedb_path => "/opt/logstash/sincedb"
 }

```

}

output {  
elasticsearch {  
host =\> localhost  
}

```
 stdout {
     codec => rubydebug
 }

```

}

## Browsing to [http://MyServer:9200/](http://MyServer:9200/) :

{  
"status" : 200,  
"name" : "Grog the God-Crusher",  
"cluster\_name" : "elasticsearch",  
"version" : {  
"number" : "1.4.5",  
"build\_hash" : "2aaf797f2a571dcb779a3b61180afe8390ab61f9",  
"build\_timestamp" : "2015-04-27T08:06:06Z",  
"build\_snapshot" : false,  
"lucene\_version" : "4.10.4"  
},  
"tagline" : "You Know, for Search"  
}

Please help!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 1, 2016, 5:50am UTC](https://discuss.elastic.co/t/elk-no-output/46019/2 "2016-04-01T05:50:14Z")

</div>

Logstash 1.4 is ancient. Please upgrade. If you can't upgrade to Logstash 2.x or later, set `protocol => "http"` for the Logstash output.

---

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [April 1, 2016, 12:51pm UTC](https://discuss.elastic.co/t/elk-no-output/46019/3 "2016-04-01T12:51:57Z")

</div>

> [@magnusbaeck](#):
>
> protocol =\> "http"

This is the version we use at our company and unfortunately I can't just upgrade. I tried setting protocol =\> "http" but then I get this error message:

> "Unknown setting 'protocol' for tcp"

---

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [April 1, 2016, 1:21pm UTC](https://discuss.elastic.co/t/elk-no-output/46019/4 "2016-04-01T13:21:15Z")

</div>

I got Kibana to log Apache logs. The strange thing is that I changed the logstash config again (about 30 minutes ago) to log HTTP request and removed the apache logs from the config. But now it is still logging the apache logs instead of the HTTP requests. Is there a delay in Kibana?

---

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [April 1, 2016, 1:39pm UTC](https://discuss.elastic.co/t/elk-no-output/46019/5 "2016-04-01T13:39:19Z")

</div>

I got this to work with:

input {  
tcp {  
port =\> 8081  
codec =\> json\_lines {  
charset =\> "UTF-8"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 1, 2016, 1:45pm UTC](https://discuss.elastic.co/t/elk-no-output/46019/6 "2016-04-01T13:45:07Z")

</div>

> "Unknown setting 'protocol' for tcp"

Modify the elasticsearch output, not the tcp input or output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:04am UTC](https://discuss.elastic.co/t/elk-no-output/46019/7 "2017-07-06T05:04:19Z")

</div>

Closed on July 6, 2017, 5:04am UTC