# Logstash CSV ingest 5.2.1 "Attempting to install template" still broken

**URL:** <https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341>\
**Category:** Logstash\
**Created:** [March 3, 2017, 4:53pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341 "2017-03-03T16:53:43Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 3, 2017, 4:53pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/1 "2017-03-03T16:53:43Z")

</div>

Spend days in this forum before posting. I have large csv file/conf file with mappings from previous ELK VM (no longer running) which worked great - alpha 5x. File permissions allow read/write to all ELK directories. This install is on local macbook Sierra 10.12.3...

logstash will not ingest my test.csv using test.conf "attempting to install template"

my test conf file

input {  
file {  
path =\> "/test.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["0","1","2"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "test"  
}  
stdout {  
codec =\> rubydebug  
}  
}

[2017-03-03T11:50:41,794][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2017-03-03T11:50:41,911][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2017-03-03T11:50:41,920][DEBUG][logstash.outputs.elasticsearch] Found existing Elasticsearch template. Skipping template management {:name=\>"logstash"}  
[2017-03-03T11:50:41,921][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#\<URI::HTTP:0x75fc9232 URL:[http://localhost:9200](http://localhost:9200)\>]}  
[2017-03-03T11:50:41,922][DEBUG][logstash.filters.csv] CSV parsing options {:col\_sep=\>",", :quote\_char=\>"""}  
[2017-03-03T11:50:41,924][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
[2017-03-03T11:50:41,929][INFO][logstash.pipeline] Pipeline main started  
[2017-03-03T11:50:41,935][DEBUG][logstash.agent] Starting puma  
[2017-03-03T11:50:41,937][DEBUG][logstash.agent] Trying to start WebServer {:port=\>9600}  
[2017-03-03T11:50:41,940][DEBUG][logstash.api.service] [api-service] start  
[2017-03-03T11:50:42,026][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-03-03T11:50:46,932][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
[2017-03-03T11:50:51,936][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
[2017-03-03T11:50:55,360][DEBUG][logstash.inputs.file] \_globbed\_files: /test.csv: glob is: []

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 5, 2017, 9:43pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/2 "2017-03-05T21:43:45Z")

</div>

> [@GregMeadows](#):
>
> path =\> "/test.csv"

What does `ls -l /test.csv` show

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 6, 2017, 5:41pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/3 "2017-03-06T17:41:05Z")

</div>

it was set to

-rw-r--r--@ 1 greg staff 18 Mar 3 10:36 test.csv  
I ran chmod 755 now test.csv is -rwxr-xr-x

however logstash still starts with "attempting to install template", does not load the test.csv or create the es index  
Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 7, 2017, 5:49am UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/4 "2017-03-07T05:49:03Z")

</div>

Can you post the entire command you are running with the output - of the ls?

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 7, 2017, 2:49pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/5 "2017-03-07T14:49:37Z")

</div>

greg$ ls -l  
total 224  
-rwxr-xr-x@ 1 greg staff 489 Mar 6 12:43 btc.conf  
-rwxr-xr-x@ 1 greg staff 104763 Mar 3 11:55 charts-test.csv  
-rwxr-xr-x@ 1 greg staff 18 Mar 3 10:36 test.csv

I get this "attempting to install template" message on any csv or conf pair even my simple test.csv, using the blog examples or the one I need for this project. ES and Kibana are running and the index is not created. Do you know anything about this attempting to install template message? Am I missing the default logstash template?

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 7, 2017, 4:18pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/6 "2017-03-07T16:18:48Z")

</div>

greg$ ls -l  
total 201264  
-rwxrwxrwx@ 1 greg staff 111569 Feb 9 22:24 [CHANGELOG.md](http://CHANGELOG.md)  
-rwxrwxrwx@ 1 greg staff 2249 Feb 9 22:24 CONTRIBUTORS  
-rwxrwxrwx@ 1 greg staff 3853 Feb 9 22:24 Gemfile  
-rwxrwxrwx@ 1 greg staff 21241 Feb 9 22:24 Gemfile.jruby-1.9.lock  
-rwxrwxrwx@ 1 greg staff 589 Feb 9 22:24 LICENSE  
-rwxrwxrwx@ 1 greg staff 29292 Feb 9 22:24 NOTICE.TXT  
drwxrwxrwx@ 11 greg staff 374 Feb 28 00:22 bin  
drwxrwxrwx 5 greg staff 170 Mar 7 09:46 bitcoin-data  
drwxrwxrwx@ 6 greg staff 204 Feb 27 23:04 config  
drwxrwxrwx@ 5 greg staff 170 Feb 28 22:39 data  
drwxrwxrwx 4 greg staff 136 Mar 3 09:55 dev  
-rwxrwxrwx 1 greg wheel 102848548 Jul 20 2016 fti2.csv  
-rwxrwxrwx@ 1 greg staff 468 Mar 3 15:46 input-bitcoin.conf  
drwxrwxrwx@ 6 greg staff 204 Feb 28 21:46 lib  
drwxrwxrwx 9 greg staff 306 Mar 7 09:41 logs  
drwxrwxrwx@ 7 greg staff 238 Mar 3 10:31 logstash-core  
drwxrwxrwx@ 6 greg staff 204 Mar 3 11:19 logstash-core-event-java  
drwxrwxrwx@ 5 greg staff 170 Feb 28 21:46 logstash-core-plugin-api  
drwxrwxrwx@ 6 greg staff 204 Mar 3 11:19 logstash-core-queue-jruby  
-rwxrwxrwx@ 1 greg staff 2662 Mar 3 10:17 logstash-fti2.conf  
-rwxrwxrwx@ 1 greg staff 313 Mar 3 11:49 test.conf  
drwxrwxrwx@ 4 greg staff 136 Feb 27 23:04 vendor  
logstash-5.2.1 greg$

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 8, 2017, 4:05pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/7 "2017-03-08T16:05:06Z")

</div>

@warkolm @magnusbaeck nothing works and it's only a simple csv test - what is "attempting to install template" mean? here is my latest config file

input {  
file {  
path =\> "/charts-test.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
ignore\_older =\> 0  
}  
}  
filter {  
csv {  
separator =\> ","  
#Date,Open,High,Low,Close,Volume (BTC),Volume (Currency),Weighted Price  
columns =\> ["Date","Open","High","Low","Close","Volume (BTC)", "Volume (Currency)" ,"Weighted Price"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "bitcoin-prices"  
}  
stdout {}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 8, 2017, 7:34pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/8 "2017-03-08T19:34:31Z")

</div>

> [@GregMeadows](#):
>
> path =\> "/charts-test.csv"

That is not valid, I think you want `./charts-test.csv` as `/charts-test.csv` refers to a file under `/`.

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 9, 2017, 4:07pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/9 "2017-03-09T16:07:49Z")

</div>

solved - using the absolute path as below worked. could this be accomplished with ingest node?

input {  
file {  
path =\> "/Users/greg/logstash-5.2.1/charts-test.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
ignore\_older =\> 0  
}  
}  
filter {  
csv {  
separator =\> ","  
#Date,Open,High,Low,Close,Volume (BTC),Volume (Currency),Weighted Price  
columns =\> ["Date","Open","High","Low","Close","Volume (BTC)", "Volume (Currency)" ,"Weighted Price"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "bitcoin-prices"  
}  
stdout {}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 9, 2017, 5:45pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/10 "2017-03-09T17:45:33Z")

</div>

Not unless you have something else that can send data to ES.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2017, 5:45pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341/11 "2017-04-06T17:45:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.