Logstash don't send data to elastic, but send it to stdout

Elastic Stack Logstash
1

Hello,

I have some problem with logstash configuration. Here is my logstash configuration

input {
    beats {
        port => 5044
    }
}

filter {
           
}

output {
    elasticsearch {
        hosts => ["localhost"]
        sniffing => true
        manage_template => false
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
    }
    stdout { codec => rubydebug }
}

So, I try to send some logs to logstash and i receive it in stdout.

{
       "message" => "[I 160523 16:31:45 web:1946] 200 GET /rest/v1/ru/advert/list?last_adv_uuid=00000000-0000-0000-0000-055984a23ea3 (192.168.200.10) 63.18ms",
      "@version" => "1",
    "@timestamp" => "2016-05-23T16:31:45.449Z",
         "count" => 1,
          "beat" => {
        "hostname" => "e3da30034825",
            "name" => "e3da30034825"
    },
        "source" => "/aiwona/service/var/logs/aiwona.log",
        "offset" => 1018227,
          "type" => "api-logs",
    "input_type" => "log",
        "fields" => nil,
          "host" => "e3da30034825",
          "tags" => [
        [0] "beats_input_codec_plain_applied"
    ]

And in ES too.

But, after 5 minutes, ES stop to accept my logs, instead of stdout.

Can anybody help me?

Thank you for reading :slight_smile:

ES configuration is default.

2

So you have some data in ES in the first 5 minutes, and after that you still have data in stdout, but not ES?

If that is the case, check if your data simply have the same id and overwrite previous ones. At least in your configuration, there is no document_id specified.

1 Like
3

Well, please close the topic, it just my local problem (_search return only 10 records :frowning: )

4

Thanks you for answering, but I already fix this problem with disable replication and enable brain :slight_smile: