# Logstash does not creates nor updates index on elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069
**Category:** Logstash
**Created:** [March 31, 2023, 5:09pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069 "2023-03-31T17:09:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Quentin\_Moisy](https://discuss.elastic.co/u/Quentin_Moisy)
#### Post date: [March 31, 2023, 5:09pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/1 "2023-03-31T17:09:39Z")
Hello, I new to the ELK flow and I have some issues with Logstash. Sometime my index will be populated sometime not. Furthermore it seems that logstash does not create index on elasticsearch. Can you help on that
My .conf file
```auto
input {
file {
path => "C:/Work/elastic/log.csv"
start_position => "beginning"
}
}
filter {
csv {
separator => ","
columns => [
"_time",
"uid",
"level"
]
}
}
output {
elasticsearch {
hosts => ["https://localhost:9200"]
user => "elastic"
password => "password"
ssl_certificate_verification => false
}
}
```
---
### Author:  [@jba](https://discuss.elastic.co/u/jba)
#### Post date: [March 31, 2023, 8:17pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/2 "2023-03-31T20:17:38Z")
Read the documentation for the logstash-output-elasticsearch plugin. I think that you need to add a `index => "......"` somewhere in the `elasticsearch {...}` part to send the documents to your chosen index.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [March 31, 2023, 8:26pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/3 "2023-03-31T20:26:00Z")
If you don't specify index name your data will end up in index:
- ECS Compatibility disabled: `"logstash-%{+yyyy.MM.dd}"`
- ECS Compatibility enabled: `"ecs-logstash-%{+yyyy.MM.dd}"`
Default is v8 in 8.x version.
As Jan said, if you want separated index, just set:
```auto
elasticsearch {
hosts => ["https://localhost:9200"]
index => "csvlog-%{+YYYY.MM.dd}"
user => "elastic"
password => "password"
ssl_certificate_verification => false
}
```
---
### Author:  [@Quentin\_Moisy](https://discuss.elastic.co/u/Quentin_Moisy)
#### Post date: [March 31, 2023, 8:55pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/4 "2023-03-31T20:55:17Z")
My apologies I didn't sent the right .conf. In the right one I have
```auto
index => "idx"
```
but I still have the issues
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [March 31, 2023, 9:05pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/5 "2023-03-31T21:05:14Z")
And again...
Since you have not set [sincedb\_path](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path), it will be created and LS keeps tracking about read lines.
Option 1 Add sincedb\_path =\> "NUL" (on Windows) bellow start\_position, LS will not use the sincedb database file, on every LS restart will read from the beginning.
Option 2 Delete sincedb before everyrestart.
---
### Author:  [@Quentin\_Moisy](https://discuss.elastic.co/u/Quentin_Moisy)
#### Post date: [April 3, 2023, 3:41pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/6 "2023-04-03T15:41:40Z")
I tried it again today and it works, thanks Rios.
The solution was to add sincedb\_path =\> "NUL" bellow start\_position as you mentioned.
```auto
input {
file {
path => "C:/Work/elastic/log.csv"
start_position => "beginning"
sincedb_path => "NUL"
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2023, 3:42pm UTC](https://discuss.elastic.co/t/logstash-does-not-creates-nor-updates-index-on-elasticsearch/329069/7 "2023-05-01T15:42:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.