It just keeps outputting the last few lines over and over.
I killed it after about 10 minutes and checked ES again. Still no indicies were created or searches worked. Out of curiosity I added a new line to logstash-tutorial.log and gave it today's date
83.149.9.216 - - [10/Oct/2016:05:13:43 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-dashboard.jpg HTTP/1.1" 200 321631 "http://semicomplete.com/presentations/logstash-monitorama-2013/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"
I briefly saw something different in the logstash debug output and now I have a new index for today as well as 1 record
$ curl 'localhost:9200/_cat/indices?v'health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open logstash-2016.10.11 5 1 1 0 19kb 19kb
From my original gist I have ignore_older => 0 and start_position => beginning per the elastic.co guide
I did not know about sincedb, thank you for pointing that out. I deleted that from my home directory and re-ran and now I have 12 records. Which I assume are 1 from my test of adding a new date to the log, 10 from the original trimmed tutorial file, and a repeat of that 1 I added because I deleted the sincedb
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.