# Index file keeps growing with no input

**URL:** <https://discuss.elastic.co/t/index-file-keeps-growing-with-no-input/106320>\
**Category:** Elasticsearch\
**Created:** [November 3, 2017, 2:07pm UTC](https://discuss.elastic.co/t/index-file-keeps-growing-with-no-input/106320 "2017-11-03T14:07:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulpsmith](https://avatars.discourse-cdn.com/v4/letter/p/2acd7d/32.png) [@paulpsmith](https://discuss.elastic.co/u/paulpsmith)\
**Post date:** [November 3, 2017, 2:07pm UTC](https://discuss.elastic.co/t/index-file-keeps-growing-with-no-input/106320/1 "2017-11-03T14:07:55Z")

</div>

Hi all. I have an odd problem and I am not sure what is happening. Not sure if this should go into the ES discussions or LS.

I am trying to get some comma separated values into ES via Logstash.  
My initial input is a csv file with 4270 lines in it. Looks like this:

09/22/2017,0,0,2,0,1,8183  
09/23/2017,0,0,0,2,3,8179  
09/24/2017,0,0,6,0,0,8185

Numbers correspond to a date some error numbers and counts of users added and removed from a user database.

I managed to create a pipeline to pump this info into ES and I can see them there in all their glorious searchability. No grok errors or anything.

Now to get this info updated daily, I want to get the user data base server to send this info to logstash via a tcp input. I created a new pipeline file with the tcp input, restarted logstash and I was able to use telnet to connect and add new lines.

However, now I am seeing the index file growing without any input to it. It is growing by about 1GB per hour. I've run a packet capture on the NIC and I am not seeing any traffic to it.

I just deleted the index and it has grown to 750 MB in the last 45 minutes or so. After deleting the index, I can't search for any data, so it looks like it is just filling this with white space.

Here are my two pipelines. First is the initial one I used to input the flat file. This was done locally on the ELK server.  
Second is the tcp pipeline.

input {  
file {  
path =\> "/opt/ldap-file/ldap-results.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["DATE","Error","Err-","Add","Change","Delete","Total"]  
}  
date {  
match =\> ["DATE", "MM/dd/yyyy"]  
}  
mutate { convert =\> ["Add", "integer"] }  
mutate { convert =\> ["Change", "integer"] }  
mutate { convert =\> ["Delete", "integer"] }  
mutate { convert =\> ["Total", "integer"] }

}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "ldap-users"  
}  
stdout {}  
}

&&&&&&&&&&&&&&&&

input {  
tcp {  
port =\> 5002  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["DATE","Error","Err-","Add","Change","Delete","Total"]  
}  
date {  
match =\> ["DATE", "MM/dd/yyyy"] }  
mutate { convert =\> ["Add", "integer"] }  
mutate { convert =\> ["Change", "integer"] }  
mutate { convert =\> ["Delete", "integer"] }  
mutate { convert =\> ["Total", "integer"] }  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "ldap-users"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2017, 2:09pm UTC](https://discuss.elastic.co/t/index-file-keeps-growing-with-no-input/106320/2 "2017-12-01T14:09:08Z")

</div>

Closed on December 1, 2017, 2:09pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.