# Lgstash is not sending data **URL:** \ **Category:** Logstash\ **Created:** [January 31, 2018, 5:20am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739 "2018-01-31T05:20:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Post date:** [January 31, 2018, 5:20am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/1 "2018-01-31T05:20:11Z")
Sending Logstash's logs to D:/Personal/logstash-6.1.2/logs which is now configured via log4j2.properties [2018-01-31T10:24:36,576][INFO][logstash.modules.scaffold] Initializing module{:module\_name=\>"fb\_apache",:directory=\>"D:/Personal/logstash-.1.2/modules/fb\_apache/configuration"} [2018-01-31T10:24:36,607][INFO][logstash.modules.scaffold] Initializing module{:module\_name=\>"netflow",:directory=\>"D:/Personal/logstash-.1.2/modules/netflow/configuration"} [2018-01-31T10:24:37,044][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-01-31T10:24:37,887][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.1.2"} [2018-01-31T10:24:38,496][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2018-01-31T10:24:46,807][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://localhost:9200/](http://localhost:9200/)]}} [2018-01-31T10:24:46,822][INFO][logstash.outputs.elasticsearch] Running healthcheck to see if an Elasticsearch connection is working {:healthcheck\_url=\>http:/ /localhost:9200/, :path=\>"/"} [2018-01-31T10:24:47,119][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://localhost:9200/](http://localhost:9200/)"} [2018-01-31T10:24:47,212][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>nil} [2018-01-31T10:24:47,212][WARN][logstash.outputs.elasticsearch] Detected a 6.xand above cluster: the `type` event field won't be used to determine the documen t \_type {:es\_version=\>6} [2018-01-31T10:24:47,244][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2018-01-31T10:24:47,275][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_f loat"}}}}}}}}[2018-01-31T10:24:47,322][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//localhost:9200](https://localhost:9200)"]}[2018-01-31T10:24:47,712][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500, :thread=\>"#\"}[2018-01-31T10:24:48,546][INFO][logstash.pipeline] Pipeline started {"[pipeline.id](http://pipeline.id)"=\>"main"} [2018-01-31T10:24:48,717][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]} # here im getting this log # this is my conf file input { file { path =\> "D:/Personal/Test\_log\_files" type =\> "file" } } filter { grok { match =\> [ "message", "%{TIME:time} %{LOGLEVEL:level} [(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}" ] overwrite =\> ["message"] } date { match =\> ["time", "MMM dd YYYY HH:mm:ss,SSS"] remove\_field =\> ["time"] } } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "logstash-%{+YYYY.MM.dd}" } stdout { codec =\> rubydebug } } im not able to c the data in the ES i have pasted the latest log in the in folder path please guide me ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 31, 2018, 5:26am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/2 "2018-01-31T05:26:04Z")
Have you looked into the file input's `start_position` option? You should look into the rest of the file input's documentation as well. ---
**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Post date:** [January 31, 2018, 5:36am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/3 "2018-01-31T05:36:52Z")
> [@magnusbaeck](#): > > start\_position Thanks & Can you please give me a example for this Magnusbaeck ---
**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Post date:** [January 31, 2018, 6:05am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/4 "2018-01-31T06:05:28Z")
I have deleted the sincedb\* file i have added start\_position now my in part is as followes input { file { path =\> "D:/Personal/Test\_log\_files/serverlog20180131" type =\> "file" start\_position =\> "beginning" } } Even after that i dont file sending data to the ES. ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 31, 2018, 6:53am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/5 "2018-01-31T06:53:44Z")
If you increase Logstash's log level you'll get additional clues about what's going on, including the path to the sincedb file that Logstash uses. ---
**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\ **Post date:** [January 31, 2018, 8:01am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/6 "2018-01-31T08:01:39Z")
Ya thanks Now its working Magnusbaeck 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 28, 2018, 8:02am UTC](https://discuss.elastic.co/t/lgstash-is-not-sending-data/117739/7 "2018-02-28T08:02:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.