# Logstash input file to es

**URL:** <https://discuss.elastic.co/t/logstash-input-file-to-es/152466>\
**Category:** Logstash\
**Created:** [October 15, 2018, 9:57am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466 "2018-10-15T09:57:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jianming](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jianming](https://discuss.elastic.co/u/jianming)\
**Post date:** [October 15, 2018, 9:57am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/1 "2018-10-15T09:57:07Z")

</div>

i test a file output to ES, and i use "/usr/share/logstash/bin/logstash -f testlog.conf", the data output to ES, it's working and i Ctrl+c , and systemctl restart logstash. the data no output to ES.  
i don't know what is the reason? who can help me  
the ES'version is 6.3.2 and the logstash'version is 6.3.2, they have been installed on the same VM.  
thanks

the test log file is very simple

"djdj  
djdfdv  
214,e  
1234  
45687  
4848  
djdjd  
djdj"

the test "conf" file is very simple.

input  
{  
file  
{  
path =\> "/root/testlog/\*.log"  
start\_position =\> "beginning"  
type =\> "testlog"  
}  
}  
output  
{  
elasticsearch {  
hosts =\> ["172.32.1.60:9200"]  
index =\> "logstash-testlog-%{+YYYY.MM.dd}"  
}  
# stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [October 15, 2018, 1:57pm UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/2 "2018-10-15T13:57:26Z")

</div>

Hi @jianming,

I think you have to check with stdout command if the logs are getting or not ?

Thanks & Regards,  
Krunal.

---

<div class="post-metadata">

**Author:** ![jianming](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jianming](https://discuss.elastic.co/u/jianming)\
**Post date:** [October 16, 2018, 1:44am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/3 "2018-10-16T01:44:55Z")

</div>

i use stdout { codec =\> rubydebug }, it's ok. and i change output to ES. and run command "/usr/share/logstash/bin/logstash -f testlog.conf " , it's work. In the kibana can be created the index. all things is work.  
but i don't use command. just use "systemctl start logstash". the data can't be output to ES. kibana haven't any index information ,so can't be create index. i see the logstash log, no error.  
i know what is the reason ?

thanks

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [October 16, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/4 "2018-10-16T10:09:22Z")

</div>

Ok.

Do one thing remove file { path } and try with stdin and then see data will sending in ES or not.

Thanks & Regards,  
Krunal.

---

<div class="post-metadata">

**Author:** ![jianming](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jianming](https://discuss.elastic.co/u/jianming)\
**Post date:** [October 24, 2018, 3:11am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/5 "2018-10-24T03:11:33Z")

</div>

i try use " /usr/share/logstash/bin/logstash -e 'input { stdin {} } output { elasticsearch { hosts =\> ["172.32.1.60:9200"] index =\> "testlog-%{+YYYY.MM.dd}" }}' "  
it's work.  
and i used root account to login and restart logstash.service,whether it's related to the root account?

---

<div class="post-metadata">

**Author:** ![jianming](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jianming](https://discuss.elastic.co/u/jianming)\
**Post date:** [October 24, 2018, 3:24am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/6 "2018-10-24T03:24:27Z")

</div>

i use /var/log/messages for input file, i use "systemctl restart logstash " to start logstash.service ,it's work. and the data output to ES.  
why i create the file, logstash can't output to ES ? i modify the file's right. 644.  
i don't know what's the reason ?

input {  
file  
{  
path =\> "/var/log/messages"  
start\_position =\> "beginning"  
type =\> "messagelog"  
}  
}

output  
{  
elasticsearch {  
hosts =\> ["172.32.1.60:9200"]  
index =\> "logstash-messageslog-%{+YYYY.MM.dd}"  
}

```
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 3:38am UTC](https://discuss.elastic.co/t/logstash-input-file-to-es/152466/7 "2018-11-21T03:38:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.