Logstash dameon does not create index .... but manually running Logstash does


I believe this is more oriented to logstash but

If I run as root:

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/01-winlogbeat-somefile.conf

Kibana sees the index file, so it is created and as long as I am running that, the index grows I can search etc....

Now, if the Logstash dameon is run, systemctl, the index is NOT created, data does NOT grow, I cannot search, etc.

Ive been at this for DAYS and I simply cannot get the answer.

The data folder is owned by logstash and I see the process is ran by logstash. Ive tried to run the dameon as root as well but it does not work.

I dont see anything in /var/log/messages

Can someone PLEASE help me out? Im going crazy.


If your service software is systemd then you may use journalctl to view the output of the service.

It was the pipelines.yml ; I had to edit it and add a additional pipeline.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.