# Logstash "elasticsearch" input doesn't start

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924>\
**Category:** Logstash\
**Created:** [April 14, 2020, 1:30pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924 "2020-04-14T13:30:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gpolini](https://avatars.discourse-cdn.com/v4/letter/g/e9a140/32.png) [@gpolini](https://discuss.elastic.co/u/gpolini)\
**Post date:** [April 14, 2020, 1:30pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924/1 "2020-04-14T13:30:29Z")

</div>

Hi!  
I'm trying to add new fields in my index documents which are calculated from data already present in the documents. For example, I have two timestamps and I have to calculate the difference in seconds.  
I wrote a logstash configuration file that take data from elatsicserach index and put the output updating documents.  
It seems that the routine doesn't start, even if I've specified the tag **schedule** or **scroll** (not both of them).  
This is imy input:

```auto
input {
  elasticsearch {
    hosts => "my_host:9200"
    index => "my_index*"
    query => '{ "query": { "bool": { "filter": [{ "exists": { "field": "time_closed" } }, { "exists": { "field": "time_open" } }, { "match_phrase": { "calc_done": false } }, { "range": { "@timestamp": { "gt": "now-3d", "lt": "now" } } }] } } }'
    tags => ["my_tag"]
# schedule => "30 * * * *"
    user => "my_elastic_user"
    password => "my_elastic_password"
    scroll => "10m"
    size => 10000
    docinfo => true
  }
}

```

I tried the query in a curl request, it returns every documents that I expect.

This is my input:

```auto
filter {
  if "my_tag" in [tags] {
    .. some calculation
    mutate {
      replace => {
        "[calc_done]" => true
      }
    }
  }
}

```

This is my output:

```auto
output {
  if "my_tag" in [tags] {
    elasticsearch {
      hosts => ["http://my_host:9200"]
      user => "my_logstash_user"
      password => "my_logstash_password"
      index => "%{[@metadata][_index]}"
      action => "update"
      doc_as_upsert => true
      document_id => "%{[@metadata][_id]}"
    }
  }
}

```

I don't see any log for this routine in logstash and elasticserach log file...  
In every documents the file "calc\_done" is false and no calculations are done...

Thanks in advance  
Giacomo

---

<div class="post-metadata">

**Author:** ![gpolini](https://avatars.discourse-cdn.com/v4/letter/g/e9a140/32.png) [@gpolini](https://discuss.elastic.co/u/gpolini)\
**Post date:** [April 21, 2020, 1:27pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924/2 "2020-04-21T13:27:43Z")

</div>

Does anyone have suggestions about my problem?

---

<div class="post-metadata">

**Author:** ![gpolini](https://avatars.discourse-cdn.com/v4/letter/g/e9a140/32.png) [@gpolini](https://discuss.elastic.co/u/gpolini)\
**Post date:** [April 23, 2020, 5:15pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924/3 "2020-04-23T17:15:12Z")

</div>

I did many tests...  
I found an interest thng: if I run logstash configuration file from another instamce of logstash, it works, even with schedule tag in input section!  
The command is  
`./bin/logstash -f <pth_of conf_file>`

On Internet I found suggestions about file rights, so I checked them and there are no difference between this file and the others tha work correctly!

I tried to run the sceond instance of logstash with user **logstash** and it didn't work, but I don't know if it's a good test...  
I tried also to change configuration file owner and group to **logstash** but I've not had any improvements...

---

<div class="post-metadata">

**Author:** ![gpolini](https://avatars.discourse-cdn.com/v4/letter/g/e9a140/32.png) [@gpolini](https://discuss.elastic.co/u/gpolini)\
**Post date:** [May 4, 2020, 6:59am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924/4 "2020-05-04T06:59:10Z")

</div>

I resolved my problem and I want to write the solution fo rpeople who have my problem.  
There's no errors on logstash configuration file, it was a concept error.

In my first ingest of data I put the tag "my\_first\_tag" in every documents.  
In this routine I put the tag "my\_tag".

So documents have both "my\_tag" and "my\_first\_tag" and they enter in two different sections "filter" and two different sections "output".

Another problem was that user logstash didn't have ownership of file /etc/default/logstash and that the directory /etc/logstash/ had group "root" instead "logstash".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2020, 6:59am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-doesnt-start/227924/5 "2020-06-01T06:59:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.