# Index not present in new ELK instance

**URL:** <https://discuss.elastic.co/t/index-not-present-in-new-elk-instance/164522>\
**Category:** Logstash\
**Created:** [January 16, 2019, 6:34pm UTC](https://discuss.elastic.co/t/index-not-present-in-new-elk-instance/164522 "2019-01-16T18:34:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lynnptilby](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lynnptilby](https://discuss.elastic.co/u/lynnptilby)\
**Post date:** [January 16, 2019, 6:34pm UTC](https://discuss.elastic.co/t/index-not-present-in-new-elk-instance/164522/1 "2019-01-16T18:34:46Z")

</div>

As root  
curl -s '[http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v)'  
Gives:

health status index uuid pri rep docs.count docs.deleted store.size pri.store.size  
green open .kibana\_1 vmG8X7ucTPWOTDn-YQxaow 1 0 3 0 11.9kb 11.9kb

My /etc/logstash/logstash.conf file is:

input {  
file {  
"path" =\> "/s3/my\_bucket/misc\_info/2018-12-06/HWM/\*"  
start\_position =\> "beginning"  
}  
}

filter {  
grok{  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp}"]  
}

date{  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss,SSSZ"]  
target =\> "timestamp"  
}  
}

output {  
elasticsearch {  
"hosts" =\> "127.0.0.1"  
"index" =\> "time2\_hwm"  
"id" =\> "time2\_hwm"  
}  
}

According to what I have read, time2\_hwm should show up in the above curl output. Are there owner/role restrictions on indexes? Note, that I am restarting logstash with 'systemctl restart logstash' with each change of my /etc/logstash/logstash.conf file.

Does what user logstash is run as, make a difference in the access to the index that is created?

What user should I be when doing the above curl command? root elasticsearch kibana or any user?

Where do I go to change the user/role/ownership/permissions in Kibana?

I have not seen any errors in /var/log/syslog indicating problems, but no index.

THANKS for your help!

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [January 21, 2019, 9:32pm UTC](https://discuss.elastic.co/t/index-not-present-in-new-elk-instance/164522/2 "2019-01-21T21:32:07Z")

</div>

please try to run this on command line and you will see what kind of result you are getting.  
Also post sample of what is in yhour file.

/usr/share/logstash/bin/logstash -f \<config\_file\_name\>

Also put this in your output section to dump output on standard output

stdout { codec =\> rubydebug }

you are also missing port on your hosts  
hosts =\> ["localhost:9200"]

you don't have to have " on hosts, index, id

I can also see that your index name is same as id. but actually it is document\_id

here is sample file that I use for testing.

list\_sample\_test file will have only two column  
A1 B1

input {  
file {  
path =\> "/tmp/list\_sample\_test"  
start\_position =\> "beginning"  
close\_older =\> 2  
discover\_interval =\> 3  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
csv {  
separator =\> " "  
columns =\> ["col1", "col2"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "test"  
document\_id =\> "%{col1}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 9:43pm UTC](https://discuss.elastic.co/t/index-not-present-in-new-elk-instance/164522/3 "2019-02-18T21:43:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.