# Logstash dont do anything after received lines

**URL:** <https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260>\
**Category:** Logstash\
**Created:** [August 22, 2025, 3:20pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260 "2025-08-22T15:20:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![trenhard](https://avatars.discourse-cdn.com/v4/letter/t/c6cbf5/32.png) [@trenhard](https://discuss.elastic.co/u/trenhard)\
**Post date:** [August 22, 2025, 3:20pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260/1 "2025-08-22T15:20:53Z")

</div>

Hello everyone. My logstash conf

```auto
input {
  file {
    path => ["/usr/local/airflow/logs/*/*/*/*.log"]
    codec => "line"
  }
}
filter {
  grok {
    match => { "path" => "/usr/local/airflow/logs/(?<dag_id>.*?)/(?<run_id>.*?)/(?<task_id>.*?)/(?<try_number>.*?).log$" }
  }
  mutate {
      add_field => {
        "log_id" => "%{[dag_id]}-%{[run_id]}-%{[task_id]}-${[try_number]}"
      }
  }
}
output {
  elasticsearch {
    hosts => ["http://xx.xx.x.xxx:9200"]
    index => "airflow-logs"
    user => 'elastic'
    password => 'default'
  }
}

```

Logstash log

```auto
[2025-08-22T07:16:29,669][DEBUG][logstash.inputs.file] Received line {:path=>"/usr/local/airflow/logs/dag_id=abonent_info_delivery_janissary/run_id=manual__2025-08-22T07:13:29.991136+00:00/task_id=abonent_1_3-pipeline.tsv_to_incremental/attempt=1.log", :text=>"PROCESS STARTED - CONVERT TSV-FILES FROM HDFS://DATA/ABONENT_INFO_DELIVERY_JANISSARY/TSV/\xD0\x9C\xD0\xA2\xD0\xA1_3/2025-08-22/1078317 TO HBASE AND SAVE TO HDFS://DATA/ABONENT_INFO_DELIVERY_JANISSARY/INCREMENTAL/\xD0\x9C\xD0\xA2\xD0\xA1_3/2025-08-22/1078317"}

```

But that's it! Then there is no sending to elastic. Please help me

Kibana Grok Debugger

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e57ed234a22919eec8c0562fbff830657bafeb64.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 22, 2025, 5:01pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260/2 "2025-08-22T17:01:44Z")

</div>

closed as a duplicate of

> [@Logstash dont do anything but received lines](https://discuss.elastic.co/t/logstash-dont-do-anything-but-received-lines/381258):
>
> Hello cyberbrothers. I came across the fact that the logtash successfully reads the lines, but does nothing further. I've spent two sleepless days on this, please take a look at it with a clear eye. My logstash conf input { file { path =\> ["/usr/local/airflow/logs/\*/\*/\*/\*.log"] codec =\> "line" } } filter { grok { match =\> { "path" =\> "/usr/local/airflow/logs/(?\<dag\_id\>.\*?)/(?\<run\_id\>.\*?)/(?\<task\_id\>.\*?)/(?\<try\_number\>.\*?).log$" } } mutate { add\_field =\> { "l…

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 22, 2025, 5:01pm UTC](https://discuss.elastic.co/t/logstash-dont-do-anything-after-received-lines/381260/3 "2025-08-22T17:01:49Z")

</div>