# Logstash can not output to elasticsearch?

**URL:** <https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119>\
**Category:** Logstash\
**Created:** [September 20, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119 "2017-09-20T07:19:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bejjm](https://avatars.discourse-cdn.com/v4/letter/b/35a633/32.png) [@bejjm](https://discuss.elastic.co/u/bejjm)\
**Post date:** [September 20, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/1 "2017-09-20T07:19:57Z")

</div>

version : logstash 5.0.2 \elasticsearch 5.0.2  
[1.My](http://1.My) configuration file in /etc/logstash/config.d/test.conf：  
input {  
file{  
path =\> "/home/installer/test//logs/test\_client.log"  
}  
}

filter {  
grok {  
match =\> {"message"=\>"%{TIMESTAMP\_ISO8601:timestamp} %{DATA:thread\_name} %{LOGLEVEL:level} %{DATA:component} %{HOSTNAME:instance} %{JAVACLASS:logger\_name} %{NOTSPACE:slm} %{GREEDYDATA:log\_message}"}  
}

json {  
source =\> "slm"  
target =\> "context"  
remove\_field =\> ["slm"]  
}  
}  
output {  
elasticsearch{  
hosts=\>["10.175.193.176:9200"]  
index=\>"lwm2m-server-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

2.And my test\_client.log file had some log message.

I used command start logstash : sudo initctl start logstash ,and logstash is running.  
But,elasticsearch no messages from 'logastsh' were received。

However，I used command to start logstash ： ./bin/logstash -f test.conf  
the elasticsearch can receive messages from 'logastsh'。

Why？  
Does anybody know what's going on?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2017, 8:22am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/2 "2017-09-20T08:22:16Z")

</div>

Perhaps the user that runs Logstash as a daemon (typically "logstash") doesn't have read access to the file.

---

<div class="post-metadata">

**Author:** ![bejjm](https://avatars.discourse-cdn.com/v4/letter/b/35a633/32.png) [@bejjm](https://discuss.elastic.co/u/bejjm)\
**Post date:** [September 20, 2017, 9:06am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/3 "2017-09-20T09:06:19Z")

</div>

Thank you for your reply。  
The logging directory ,/home/installer/test/logs/ was root:root , so I chown'd both to chown -R logstash:logstash .  
But problems remain。

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2017, 9:34am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/4 "2017-09-20T09:34:00Z")

</div>

And what are the permissions of /home, /home/installer, and /home/installer/test?

---

<div class="post-metadata">

**Author:** ![bejjm](https://avatars.discourse-cdn.com/v4/letter/b/35a633/32.png) [@bejjm](https://discuss.elastic.co/u/bejjm)\
**Post date:** [September 20, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/5 "2017-09-20T11:10:31Z")

</div>

Thank you very much.I solved the problem by your method.  
But I don't understand，I had set the file as all users can be read.  
[installer@test test]  
drwxr-xr-x. 8 installer installer 4096 Sep 19 21:53 logs

Why must 'chown -R logstash:logstash /home/test/' be executed before the file can be read?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2017, 11:24am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/6 "2017-09-20T11:24:11Z")

</div>

All directories leading up to a file must be executable to the user attempting to access the file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2017, 11:24am UTC](https://discuss.elastic.co/t/logstash-can-not-output-to-elasticsearch/101119/7 "2017-10-18T11:24:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.