# Logstash index without timestemp

**URL:** https://discuss.elastic.co/t/logstash-index-without-timestemp/41141
**Category:** Logstash
**Created:** [February 7, 2016, 2:23pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141 "2016-02-07T14:23:26Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [February 7, 2016, 2:23pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/1 "2016-02-07T14:23:27Z")

</div>

hello all,

i'm ELK newbie and i having a few problems with log reading.

i'm trying to read a csv file that have no times-temp field in it.  
for that i built configuration file using this guide help ([https://kevinkirsche.com/2014/08/25/using-logstash-to-import-csv-files-into-elasticsearch/](https://kevinkirsche.com/2014/08/25/using-logstash-to-import-csv-files-into-elasticsearch/)).  
but still the in kibana i cant create index pattern for the specific file. i cant help to find the right **Input type** to use.

appreciate the help.

guy

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 7, 2016, 2:30pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/2 "2016-02-07T14:30:15Z")

</div>

> but still the in kibana i cant create index pattern for the specific file.

What does your elasticsearch output in your Logstash config look like?

> i cant help to find the right Input type to use.

What do you mean? If you're talking about the `type` field set via the `input` option of your input plugin, that's just an arbitrary string.

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [February 7, 2016, 2:51pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/3 "2016-02-07T14:51:35Z")

</div>

hi,

(sorry abut the typo at the provisos massage)

attached the config file:

input {  
file {  
path =\> "/tmp/\*.csv  
type =\> "file"  
start\_position =\> "beginning"  
}  
}  
filter {  
csv {  
columns =\> ["Sess IDL4 ProtoIn", "ternal IP PortI", "External IP PortE", "TTL DPI Stat","App"]  
separator =\> " "  
}  
}  
output {  
elasticsearch {  
action =\> "index"  
host =\> "localhost"  
index =\> "logstash-%{+YYYY.MM.dd}"  
workers =\> 1  
}  
}

i know i have to change the **index** but to what?

thanks,  
guy

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 7, 2016, 3:03pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/4 "2016-02-07T15:03:49Z")

</div>

Why would you have to change the index name?

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [February 7, 2016, 3:07pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/5 "2016-02-07T15:07:59Z")

</div>

because in the kibana i can't create index pattern and no data is being read from the csv file.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 7, 2016, 3:59pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/6 "2016-02-07T15:59:17Z")

</div>

Are there any indexes in ES? If not you can't create an index pattern. Changing the index name won't make a difference.

If Logstash isn't reading your CSV files it's probably because it's tailing the files and no more data is being added. `start_position => "beginning"` only matters for unseen files. This matter has been covered here many many times. Setting `sincedb_path` to "/dev/null" effectively disables the sincedb feature which tracks the current position in each file (and most likely points to the end of the file right now).

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [February 7, 2016, 7:39pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/7 "2016-02-07T19:39:25Z")

</div>

Thanks for your answare and for your patienc. but as i said ELK is new to me so i'll try to better expline myself.

I have a static csv file with 500k lines i have to slice and dice but i can't understand how to connect to the file and display all the data in it.  
Using the sincedb\_path will resolve my problem?

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 7, 2016, 8:51pm UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/8 "2016-02-07T20:51:51Z")

</div>

Yes, probably. I suggest you try it out rather than ask me about it. I'm just guessing.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/logstash-index-without-timestemp/41141/9 "2017-07-06T05:12:46Z")

</div>


