# Logstash can read and loaded the files into ES. But I cannot find the data in ES **URL:** \ **Category:** Elasticsearch\ **Created:** [May 12, 2020, 10:02am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190 "2020-05-12T10:02:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![logittech](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@logittech](https://discuss.elastic.co/u/logittech)\ **Post date:** [May 12, 2020, 10:02am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/1 "2020-05-12T10:02:37Z")
Hi all, I'm trying to load the data into ES. It seems like Logstash can read the files and loaded it into ES. But the doc\_count in Kibana/ES show 0 and I cannot create the index pattern. I'm using ES:7.6.1; Kibana:7.6.1 This is my conf file: ``` input{ file{ path => "/home/chanchowing/log-users_route_2/*.csv" start_position => "beginning" } } filter{ csv{ separator => "," columns => ["_id", "user", "lat", "lng", "alt", "createdAt", "updatedAt"] } mutate { convert => { "lat" => "float" "lng" => "float" "alt" => "float" } } date { match => ["createdAt", "yyyy-MM-dd HH:mm:ss,SSS Z", "ISO8601"] } date { match => ["updatedAt", "yyyy-MM-dd HH:mm:ss,SSS Z", "ISO8601"] } } output{ elasticsearch{ hosts => ["localhost:9200"] index => "5g_1" } stdout { codec => rubydebug } } ``` Logstash can read the file and loaded it into ES ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3dec6e441ea36eeb82a4ec215880c9ba3f5c3a34.png) But the doc\_count is 0 in Kibana ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad727612123c1547257a4c349c6f9e9dfd9be08f.png) And I cannot find the indices in the index patterns. So I cannot create a index pattern. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8cfa7f6ce15c352788225a92d84bbb820cff6321.png) the doc count is also 0 in ES ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e3242d11914df2c4ab58d4508f8daaa2229d12b7.png) and also I need to restart my VM if i want to load another file even I changed the path.name. This is the error message: > [LogStash: Runner] runner - Logstash count not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the “path.data” setting. > > [LogStash: Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error : (SystemExit) exit So my question is: 1. the doc count = 0 is because the data never load into ES? if yes, anything wrong in the conf file? or how can I fix this? 2. I cannot find the indices name(5g\_1) in the index patterns because 5g\_1: doc count =0? 3. why I need to restart my VM to load another file via logstash. Thank's for your help. Gladys ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 12, 2020, 10:05am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/2 "2020-05-12T10:05:30Z")
Welcome! Please don't post pictures of text, they are difficult to read, impossible to search and some people may not be even able to see them 🙂 This may be because of sincedb. Can you try setting that to `/dev/null` and reprocessing the file? [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb\_path](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 12, 2020, 10:10am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/3 "2020-05-12T10:10:12Z")
I would try renaming the index as I am not sure it is allowed to start with a digit. ---
**Author:** ![logittech](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@logittech](https://discuss.elastic.co/u/logittech)\ **Post date:** [May 12, 2020, 10:37am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/4 "2020-05-12T10:37:28Z")
Hi warkolm, Thanks for the response. Sorry about posting pic of text. I will replace the pic with text right after I back home. May I know 'setting that to /dev/null' means adding sincedb\_path =\> "/dev/null" in input like below? ``` input{ file{ path => "/home/chanchowing/log-users_route_2/*.csv" start_position => "beginning" sincedb_path => "/dev/null" } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 12, 2020, 10:08pm UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/5 "2020-05-12T22:08:45Z")
Yes that is right 🙂 ---
**Author:** ![logittech](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@logittech](https://discuss.elastic.co/u/logittech)\ **Post date:** [May 13, 2020, 3:52am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/7 "2020-05-13T03:52:04Z")
That's works! Thanks a lot. And I also change one of the field name: \_id to id. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 10, 2020, 3:52am UTC](https://discuss.elastic.co/t/logstash-can-read-and-loaded-the-files-into-es-but-i-cannot-find-the-data-in-es/232190/8 "2020-06-10T03:52:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.