# Logstash + Elasticsearch + Windows Server

**URL:** https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691
**Category:** Elasticsearch
**Created:** [March 17, 2016, 10:28am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691 "2016-03-17T10:28:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Vakhtang\_Badzhadze](https://avatars.discourse-cdn.com/v4/letter/v/58956e/32.png) [@Vakhtang\_Badzhadze](https://discuss.elastic.co/u/Vakhtang_Badzhadze)
#### Post date: [March 17, 2016, 10:28am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691/1 "2016-03-17T10:28:37Z")

</div>

Hi ?  
I have windows server 2012 and installed logstash 2.2 and elastic 2.2 on it.  
Log stash config:

> input {  
> file {  
> start\_position =\> "beginning"  
> type =\> "log4net"  
> path =\> ["D:/Other Programms/ELK/logstash/bin/logs/log.log"]  
> }  
> }  
> filter {  
> if [type] == "log4net" {  
> grok {  
> pattern =\> ["%{TIMESTAMP\_ISO8601:sourceTimestamp} [%{DATA:threadId}] %{LOGLEVEL:level} %{WORD:logger}"]  
> }  
> }  
> }

> output {  
> stdout {  
> codec =\> line {  
> format =\> " Hello - %{sourceTimestamp}. "  
> }  
> }  
> file {  
> path =\> ["D:/Other Programms/ELK/logstash/bin/logs/test.log"]  
> }  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> index =\> "Logs"  
> }  
> }  
> Logstash starting and work, but i cant find logs in elasticstash !

elasticstash works  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2b8ce0fe1d81870c84636b9b428c1fc96b06f163.JPG)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 18, 2016, 4:35am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691/2 "2016-03-18T04:35:49Z")

</div>

It's probably this - [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb\_path](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path)

Find the sincedb file, delete it and then restart LS.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 19, 2016, 3:26pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691/3 "2016-03-19T15:26:32Z")

</div>

Also check out the `ignore_older` option if the input file is older than 24 hours.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:06pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-windows-server/44691/4 "2017-07-05T23:06:53Z")

</div>