# Error while testing pipeline **URL:** \ **Category:** Logstash\ **Created:** [February 26, 2018, 5:20am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431 "2018-02-26T05:20:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![amiyadutta](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@amiyadutta](https://discuss.elastic.co/u/amiyadutta)\ **Post date:** [February 26, 2018, 5:20am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/1 "2018-02-26T05:20:52Z")
Hi, When we run the following command to test the pipeline - curl -XGET 'localhost:9200/logstash-$DATE/\_search?pretty&q=response=200' output is - { "error" : { "root\_cause" : [ { "type" : "index\_not\_found\_exception", "reason" : "no such index", "resource.type" : "index\_or\_alias", "resource.id" : "logstash-$DATE", "index\_uuid" : "_na_", "index" : "logstash-$DATE" } ], "type" : "index\_not\_found\_exception", "reason" : "no such index", "resource.type" : "index\_or\_alias", "resource.id" : "logstash-$DATE", "index\_uuid" : "_na_", "index" : "logstash-$DATE" }, "status" : 404 } Our goal is send filebeat output to logstash and logstash output to elasticsearch. Please Note - Output of - "curl 'localhost:9200/\_cat/indices?v'" health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open filebeat-6.2.2-2018.02.23 \_kjNzUMkRia5nOmVKOW-Tw 3 1 3210 0 558.4kb 558.4kb We have followed the guideline - [https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 26, 2018, 6:58am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/2 "2018-02-26T06:58:14Z")
You've single-quoted the URL in your command so the `$DATE` environment variable reference won't be expanded. If you instead double-quote the string the variable will be expanded. I'm of course assuming that you're setting the DATE varaible to a reasonable value. ---
**Author:** ![amiyadutta](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@amiyadutta](https://discuss.elastic.co/u/amiyadutta)\ **Post date:** [February 26, 2018, 7:09am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/3 "2018-02-26T07:09:10Z")
Below is the conf file "first-pipeline.conf" we have used here. The file is at path -- /etc/logstash/conf.d/first-pipeline.conf # The # character at the beginning of a line indicates a comment. Use # comments to describe your configuration. input { beats { port =\> "5044" } } # The filter part of this file is commented out to indicate that it is # optional. filter { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}"} } date { match =\> ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } geoip { source =\> "clientip" } } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } In case we are doing anything wrong regarding setting the DATE varaible to a reasonable value, please guide. As you suggested, we have executed the same command with double-quotes, but result was same. Below is the output. [root@elkstack ~]# curl -XGET "localhost:9200/logstash-$DATE/\_search?pretty&q=response=200" { "error" : { "root\_cause" : [ { "type" : "index\_not\_found\_exception", "reason" : "no such index", "resource.type" : "index\_or\_alias", "resource.id" : "logstash-", "index\_uuid" : "_na_", "index" : "logstash-" } ], "type" : "index\_not\_found\_exception", "reason" : "no such index", "resource.type" : "index\_or\_alias", "resource.id" : "logstash-", "index\_uuid" : "_na_", "index" : "logstash-" }, "status" : 404 } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 26, 2018, 7:32am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/4 "2018-02-26T07:32:37Z")
So you're not setting the DATE variable in your shell? Then why do you expect a shell command that includes $DATE to work? I don't understand what you're trying to do. ---
**Author:** ![amiyadutta](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@amiyadutta](https://discuss.elastic.co/u/amiyadutta)\ **Post date:** [February 26, 2018, 8:23am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/5 "2018-02-26T08:23:15Z")
> [@magnusbaeck](#): > > DATE variable DATE variable is defined, please find the below output - [root@elkstack ~]# echo $DATE 2018.02.26 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 26, 2018, 8:34am UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/6 "2018-02-26T08:34:26Z")
The most recent command output you posted indicates that the variable isn't defined. If you prepend the command with `echo` you'll see exactly what you would execute without actually executing it. ---
**Author:** ![amiyadutta](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@amiyadutta](https://discuss.elastic.co/u/amiyadutta)\ **Post date:** [February 26, 2018, 4:01pm UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/7 "2018-02-26T16:01:08Z")
Happy to let you know that the issue is resolved. As we were using Filebeat and output is set to Logstash, the index is of the pattern "Filebeat-$DATE". The index is now also accessible at Kibana 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 26, 2018, 4:01pm UTC](https://discuss.elastic.co/t/error-while-testing-pipeline/121431/8 "2018-03-26T16:01:22Z")
Closed on March 26, 2018, 4:01pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.