Getting Error : ( Unable to fetch mapping.Do you have indices matching the pattern?)

I have logstash (V - 5.4.0) installed on a local server and elasticsearch and kibana on another server (both of V - 5.4.3).

I have installed X-pack (V - 5.4.3) on elasticsearch and kibana.

but when i'm trying to load data on user elastic using config file :

input {
  file {
    path => "/opt/demo.dat"
    start_position => "beginning"
   sincedb_path => "/dev/null"
  }
}
filter {
  csv {
      separator => ","
     columns => ["seq_num","name","country"]
  }
}
output {
   elasticsearch {
     hosts => ["http://10.1.1.150:9200"]
     user => "elastic"
     password => "changeme"
     index => "demo"
  }
stdout {}
}

the data gets loaded successfully

[root@monitor logstash]# /usr/share/logstash/bin/logstash -f /opt/demo.conf --path.data /opt/dir1
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
2017-09-21T06:49:44.192Z monitor.htintra.net 1,Raj,Ind
2017-09-21T06:49:44.209Z monitor.htintra.net 2,William,Aus
2017-09-21T06:49:44.210Z monitor.htintra.net 3,Roger,USA

But i'm not able to see the index demo

curl --user elastic:changeme '10.1.1.150:9200/_cat/indices/demo?v'

getting error using the above command

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"demo","index_uuid":"_na_","index":"demo"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"demo","index_uuid":"_na_","index":"demo"},"status":404}[

And in kibana, not able to see demo index

Can you run curl --user elastic:changeme '10.1.1.150:9200/_cat/indices' and show us the output?

[root@monitor elasticsearch]# curl --user elastic:changeme '10.1.1.150:9200/_cat/indices'
yellow open .kibana                         hM6t3DeIQXSUL9X9aR1Ung 1 1     16   0  37.7kb  37.7kb
yellow open .triggered_watches              jfhCuse5SmKseksmaJwwAQ 1 1      0   0   1.2mb   1.2mb
yellow open logstash-                       ATn1KyU4QzqDL3GAFSr9Vw 5 1      0   0    650b    650b
yellow open report                          cWWwVCYPSaW79ZB8nodU0w 5 1  10320   0   5.1mb   5.1mb
yellow open .reporting-2017.09.17           u2xbKXnXRdaLg273JPEdVA 5 1      1   0 530.5kb 530.5kb
yellow open .watcher-history-3-2017.09.20   6TBWZVyBTH2gd6DBBjwwgA 1 1   7190   0   5.8mb   5.8mb
yellow open .monitoring-kibana-2-2017.09.21 smI2esRRRPSozWyfDaweIw 1 1    755   0 300.6kb 300.6kb
yellow open hr_data                         4s-oG1hRQ_euWj8NZ-Umvg 5 1  10320   0   4.9mb   4.9mb
yellow open .monitoring-es-2-2017.09.21     yNFsCGb3RSSoLYVJMFuHnA 1 1  19956 497    12mb    12mb
yellow open .monitoring-es-2-2017.09.19     ulTDMfTBQ0ilCthA3msIiw 1 1 137571 188  66.7mb  66.7mb
green  open .security                       YKv-ojdwTZ2kaPpKMZHNeQ 1 0      2   0   8.8kb   8.8kb
yellow open .watcher-history-3-2017.09.21   Toiw8vnuSfGjGbEo7txXTg 1 1    630   0 617.2kb 617.2kb
yellow open test                            sDBtENICSx2P2NzPGwRw0A 1 1      0   0    159b    159b
yellow open .monitoring-kibana-2-2017.09.19 _40W0qHERRiOFvBz9M0OKw 1 1   2172   0 555.8kb 555.8kb
yellow open .watches                        hWpUqhDaTk-mTrkHIOn4og 1 1      4   0  30.9kb  30.9kb
yellow open .monitoring-es-2-2017.09.20     nYiR5zdcQwuB8LLecesJhA 1 1 188535 565  97.4mb  97.4mb
yellow open .monitoring-data-2              2MdO6dROTp2FM702yRbmkQ 1 1      3   0  14.3kb  14.3kb
yellow open .monitoring-kibana-2-2017.09.20 jfqnGQs8TGShW_8N5yr6IQ 1 1   8632   0   1.7mb   1.7mb
yellow open .watcher-history-3-2017.09.19   toewY5uFRFKBGPwR5N1vWQ 1 1   6385   0   5.1mb   5.1mb
yellow open .monitoring-alerts-2            eH4d_9KCSDqRTvGgYgvEfQ 1 1      1   0    13kb    13kb

There doesn't look like there is a demo index in there. So I'd run Logstash again and check _cat/indices again.

I restarted logstash and loaded the data again with the logstash command but still i can't see demo on index list.
Is there any changes need to be made after installing X-Pack to read the index or it is a logstash issue ?

Any suggestions would be helpful.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.