# Index not created, logstash

**URL:** <https://discuss.elastic.co/t/index-not-created-logstash/196110>\
**Category:** Logstash\
**Created:** [August 21, 2019, 12:38pm UTC](https://discuss.elastic.co/t/index-not-created-logstash/196110 "2019-08-21T12:38:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hunter84](https://avatars.discourse-cdn.com/v4/letter/h/85f322/32.png) [@hunter84](https://discuss.elastic.co/u/hunter84)\
**Post date:** [August 21, 2019, 12:38pm UTC](https://discuss.elastic.co/t/index-not-created-logstash/196110/1 "2019-08-21T12:38:13Z")

</div>

Hello!  
I have windows 2012 server, it runs an ELK stack. I am trying to parse using logstash, the index has not yet been created in elastiсsearch, and it does not appear after running the config file.

input {  
file {  
codec =\> multiline {  
pattern =\> "^([0-5][0-9]):[0-5][0-9]"  
negate =\> true  
what =\> previous  
auto\_flush\_interval =\> 10  
}  
type =\> "TZH"  
path =\> ["//server/d$/TJ\_logs/TLockErr/rphost\*/\*.log"]  
start\_position =\> "end"  
stat\_interval =\> 1  
discover\_interval =\> 30  
}  
}  
filter {  
grok {  
match =\> {"path" =\> "(?(?:\w{2}\w{10}))/(?(?:\S{2}))/%{WORD:cat1}/%{WORD:cat2}/rphost\_(?(?:\d+))/(?(?:\d+{2}))(?(?:\d+{2}))(?(?:\d+{2}))(?(?:\d+{2}))"}  
}  
grok {  
match =\> {"message" =\> "(?(%{MINUTE}:%{SECOND}))-%{INT:duration},%{WORD:type},%{INT:level},%{GREEDYDATA:kv}"}  
}  
kv {  
field\_split =\> ","  
value\_split =\> "="  
}  
mutate {  
add\_field =\> ["my\_timestamp","%{day}-%{month}-20%{year} %{hour}:%{minsec}"]  
}  
date {  
match =\> ["my\_timestamp", "dd-MM-yy HH:mm:ss.SSSSSS", "ISO8601"]  
target =\> "@timestamp"  
}  
mutate {  
remove\_field =\> ["my\_timestamp","kv","day", "month","year","hour","minsec","kv","cat1","cat2","disk"]  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "temp\_tlockerr"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2019, 12:38pm UTC](https://discuss.elastic.co/t/index-not-created-logstash/196110/2 "2019-09-18T12:38:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.