Logstash is not exported data to ElasticSearch

Hello All, I am new to ES and experimenting with the product.
I have configured Logstash to exported data to ES with the host set to "localhost". "localhost" was set in the ES configuration files also. However, now I changed the settings of ES to an IP Address. Thus, in Logstask config file I have reflected the same. When the setting was "localhost", the data was imported successfully however after the change to IP address, the data fails to exports. There is no error message. I have captured a screenshot below. Any suggestions are welcome.

It is connecting to elasticsearch and does not log an error when it attempts to install the template, so it is able to write to elasticsearch. That suggests the inputs are not generating any events. What does you input configuration look like.

BTW, please do not post pictures of text, just copy and paste the text and click on </> in the toolbar above the edit pane...

here is my config file....


input {
file {
path => "D:/ELK-Runnable/Logstash/Input/india-trade-data/2018-2010_export.csv"
start_position => "beginning"
}
}
filter {
csv {
separator => ","
columns => ["HSCode","Commodity","value","country","year"]
}
}

output {
elasticsearch {
hosts => ["http://192.168.119.1:9200"]
index => "india_trade_data"
}
stdout {}
}

You have a sincedb, and if you previously ran that configuration (with the host set to localhost) then the file input will have persisted the fact that it read to the end of the file. So when logstash was started with the IP address it will have skipped to the end of file and is waiting for new data to be appended.

You can force it to re-read the file from the beginning by stopping logstash, deleting the sincedb (the path to it is logged at startup, as you can see from your screenshot), and then starting logstash again.

Thanks. That worked. Appreciate the help :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.