# Logstash-\* index is not getting created after installing x-pack5.2.2

**URL:** <https://discuss.elastic.co/t/logstash-index-is-not-getting-created-after-installing-x-pack5-2-2/96957>\
**Category:** Logstash\
**Created:** [August 14, 2017, 11:21am UTC](https://discuss.elastic.co/t/logstash-index-is-not-getting-created-after-installing-x-pack5-2-2/96957 "2017-08-14T11:21:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shraddha1](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@shraddha1](https://discuss.elastic.co/u/shraddha1)\
**Post date:** [August 14, 2017, 11:21am UTC](https://discuss.elastic.co/t/logstash-index-is-not-getting-created-after-installing-x-pack5-2-2/96957/1 "2017-08-14T11:21:38Z")

</div>

Hi,

I have installed ELK 5.2.2 and x-pack 5.2.2  
After installing x-pack, logstash-\* index is not getting created.  
logstash.conf file is as below

input {  
lumberjack {  
port =\> 5044  
type =\> "logs"  
ssl\_certificate =\> "key\_path"  
ssl\_key =\> "key\_path"  
}  
}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGLINE}" }  
}  
mutate {  
split =\> { "message" =\> "~" }  
}  
json{  
source =\> "message"  
}  
date {  
match =\> ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

output {  
elasticsearch {  
hosts =\> ":9200" index =\> "logstash-%{+YYYY.MM.dd}" user =\> "logstash\_user" password =\> ""  
}  
stdout {codec =\> rubydebug}  
}

logstash\_user belongs to role logstash\_reader and logstash\_writer  
curl -u logstash\_user 'http://:9200/\_xpack/security/\_authenticate?pretty=true'  
Enter host password for user 'logstash\_user':  
{  
"username" : "logstash\_user",  
"roles" : [  
"logstash\_system",  
"logstash\_reader",  
"logstash\_writer",  
"monitoring\_user",  
"superuser",  
"reporting\_user"  
],  
"full\_name" : "Internal Logstash User",  
"email" : "",  
"metadata" : { },  
"enabled" : true  
}

Done all possible steps that are present in below link  
[https://www.elastic.co/guide/en/x-pack/5.2/logstash.html](https://www.elastic.co/guide/en/x-pack/5.2/logstash.html)

Logstash is not parsing the log and also not creating logstash-\* index. logstash-forwader is installed to forward the logs to logstash

Can you please help to understand this issue?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2017, 11:21am UTC](https://discuss.elastic.co/t/logstash-index-is-not-getting-created-after-installing-x-pack5-2-2/96957/2 "2017-09-11T11:21:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.