# ELK stack elasticsrearch index issue

**URL:** <https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861>\
**Category:** Elasticsearch\
**Created:** [January 24, 2018, 12:09pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861 "2018-01-24T12:09:23Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![shufil](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@shufil](https://discuss.elastic.co/u/shufil)\
**Post date:** [January 24, 2018, 12:09pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/1 "2018-01-24T12:09:24Z")

</div>

I have installed ELK to analyze our log files in ubuntu 14, using nginx - kibana - elasticsearch -logstsh --- logstash client server (filebeate) nginx connected to kibana with port 5601 ,and elasticsearch.yml is running with settings

network.host: localhost  
logstsh working with below configaration , also i have Loaded Kibana Dashboards with beats-dashboards-1.1.0.zip, its loaded [filebeat-]YYYY.MM.DD still i did not getting any logs in kibana, please check the screen short .

 ![ELK](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d727441b839119b90088825c3fcbd62dca4408a3.png)

\</\>input {  
beats {  
port =\> 5043  
type =\> syslog  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

### 

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

## 

output {  
elasticsearch {  
host =\> "localhost:9200"  
}  
}  
#I have tried below also  
#output {

# elasticsearch {

# host =\> "localhost:9200"

# sniffing =\> true

# manage\_template =\> false

# index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

# document\_type =\> "%{[@metadata][type]}"

## }

#}  
client system running with filebeat data type syslog file type /var/log/auth-log

filebeat:  
prospectors:  
paths:  
- /var/log/auth.log  
input\_type: log  
document\_type: syslog  
registry\_file: /var/lib/filebeat/registry  
output:  
logstash:  
hosts: ["ELK\_server\_IP:5043"]  
bulk\_max\_size: 2048  
tls:  
certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]  
shipper:  
logging:  
files:  
rotateeverybytes: 10485760 \</\>

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 24, 2018, 12:54pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/2 "2018-01-24T12:54:36Z")

</div>

Please format your code using `</>` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable.

Or use markdown style like:

````
```
CODE
```

````

Please edit your post.

Looks like very old versions... Why did you choose to install that instead of 6.1.2?

---

<div class="post-metadata">

**Author:** ![shufil](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@shufil](https://discuss.elastic.co/u/shufil)\
**Post date:** [January 24, 2018, 2:28pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/3 "2018-01-24T14:28:25Z")

</div>

Thanks for reply , i have updated elastcsreach version from 4.2 to 6.x , and kibana to 5,  
still am stuck in Create index pattern, please check the screenshot .

 ![kibana](https://us1.discourse-cdn.com/elastic/original/3X/7/1/713c8f6192a137c35709d8474ddab40ae2ef50db.png)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 24, 2018, 2:41pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/4 "2018-01-24T14:41:44Z")

</div>

Looks like a Kibana 6, no?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 24, 2018, 2:42pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/5 "2018-01-24T14:42:36Z")

</div>

Did you index anything?

What gives `GET _cat/indices?v`

---

<div class="post-metadata">

**Author:** ![shufil](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@shufil](https://discuss.elastic.co/u/shufil)\
**Post date:** [January 24, 2018, 5:02pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/6 "2018-01-24T17:02:20Z")

</div>

currently i did not index anything , how can i do index?, basically am in new in ELK  
curl -I [http://localhost:5601/status](http://localhost:5601/status)  
HTTP/1.1 200 OK  
kbn-name: kibana  
**kbn-version: 6.1.2**  
cache-control: no-cache  
Date: Wed, 24 Jan 2018 17:00:51 GMT  
Connection: keep-alive

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 24, 2018, 5:32pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/7 "2018-01-24T17:32:00Z")

</div>

You can go in the developer Console in Kibana and do:

```auto
DELETE test
PUT test/doc/1
{
  "message": "Elasticsearch is cool"
}
GET test/_search?q=cool

```

May be read  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.1/getting-started.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/getting-started.html)

And specifically  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.1/\_exploring\_your\_data.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/_exploring_your_data.html)

HTH

---

<div class="post-metadata">

**Author:** ![shufil](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@shufil](https://discuss.elastic.co/u/shufil)\
**Post date:** [January 24, 2018, 6:20pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/8 "2018-01-24T18:20:20Z")

</div>

yes i added default index in elasticsreach using below url reference, and kibana now working fine  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.1/\_exploring\_your\_data.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/_exploring_your_data.html)

But how can i get my filebeate client logs ??

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 24, 2018, 6:48pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/9 "2018-01-24T18:48:58Z")

</div>

Did you read [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html) ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2018, 6:49pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861/10 "2018-02-21T18:49:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.