# Logstash is not reading logstash.conf file **URL:** \ **Category:** Logstash\ **Created:** [October 18, 2018, 8:01am UTC](https://discuss.elastic.co/t/logstash-is-not-reading-logstash-conf-file/152954 "2018-10-18T08:01:52Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![krajapraveen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krajapraveen/32/45708_2.png) [@krajapraveen](https://discuss.elastic.co/u/krajapraveen)\ **Post date:** [October 18, 2018, 8:01am UTC](https://discuss.elastic.co/t/logstash-is-not-reading-logstash-conf-file/152954/1 "2018-10-18T08:01:52Z")
Hi I have installed Elastic Search, Logstash and Kibana on my windows laptop. Windows directory path to Kibana: C:\Users\rajapraveenk\Downloads\kibana-6.4.2-windows-x86\_64 Windows directory path to Logstash: C:\Users\rajapraveenk\Downloads\logstash-6.4.2\logstash-6.4.2 Windows directory path to Elastic search: C:\Users\rajapraveenk\Downloads\elasticsearch-6.4.2\elasticsearch-6.4.2 I have my logstash.conf file in C:\Users\rajapraveenk\Downloads\elasticsearch-6.4.2\elasticsearch-6.4.2\config\logstash.conf My logstash.conf file contains below data input { file { path =\> "/var/lib/tomcat8/logback/\*.log" codec =\> "json" type =\> "logback" } } output { if [type]=="logback" { elasticsearch { hosts =\> ["localhost:9200"] index =\> "logback-%{+YYYY.MM.dd}" } } } To see the logs in Kibana, I have initially started Elastic Search by providing C:\Users\rajapraveenk\Downloads\elasticsearch-6.4.2\elasticsearch-6.4.2\bin\elasticsearch.bat in the windows command prompt. Then I started logstash by providing C:\Users\rajapraveenk\Downloads\logstash-6.4.2\logstash-6.4.2\bin\> logstash -f C:\Users\rajapraveenk\Downloads\logstash-6.4.2\logstash-6.4.2\config\logstash.conf The console logs of windows command prompt after running the logsatsh.conf file is as below Sending Logstash logs to C:/Users/rajapraveenk/Downloads/logstash-6.4.2/logstash-6.4.2/logs which is now configured via log4j2.properties [2018-10-18T13:10:47,159][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-10-18T13:10:47,812][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.4.2"} [2018-10-18T13:10:52,120][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} [2018-10-18T13:10:52,903][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://localhost:9200/](http://localhost:9200/)]}} [2018-10-18T13:10:52,927][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"} [2018-10-18T13:10:53,166][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://localhost:9200/](http://localhost:9200/)"} [2018-10-18T13:10:53,267][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>6} [2018-10-18T13:10:53,273][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6} [2018-10-18T13:10:53,305][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//localhost:9200](https://localhost:9200)"]} [2018-10-18T13:10:53,338][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2018-10-18T13:10:53,393][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} [2018-10-18T13:10:53,999][INFO][logstash.inputs.file] No sincedb\_path set, generating one based on the "path" setting {:sincedb\_path=\>"C:/Users/rajapraveenk/Downloads/logstash-6.4.2/logstash-6.4.2/data/plugins/inputs/file/.sincedb\_bec0d662147837b9e3af8a448a7d314b", :path=\>["/var/lib/tomcat8/logback/\*.log"]} [2018-10-18T13:10:54,054][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} [2018-10-18T13:10:54,135][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [2018-10-18T13:10:54,154][INFO][filewatch.observingtail] START, creating Discoverer, Watch with file and sincedb collections [2018-10-18T13:10:54,613][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} I don't know whether logstash is reading the logstash.conf file or not When I ran Kibana by providing below like C:\Users\rajapraveenk\Downloads\kibana-6.4.2-windows-x86\_64\kibana-6.4.2-windows-x86\_64\bin\kibana.bat I could not find my index pattern when search for logback- in the index pattern field in Kibana server. Please find below screenshot for your reference. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6bc5905bb37f598dd4ba0f7de4cc9a9d2db808e.jpeg) Can anyone help me.... ---
**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\ **Post date:** [October 22, 2018, 12:17pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-logstash-conf-file/152954/2 "2018-10-22T12:17:12Z")
HI, As observed above, I think you were completely new to ELK, keep conf file in logstash folder cd logstash bin\logstash -f xxxx.conf Also , give the path properly, Wrong format: path =\> "/var/lib/tomcat8/logback/\*.log" correct format: path = "C:/Users/rajapraveenk/Downloads/sample.xml" ---
**Author:** ![krajapraveen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krajapraveen/32/45708_2.png) [@krajapraveen](https://discuss.elastic.co/u/krajapraveen)\ **Post date:** [October 31, 2018, 3:54pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-logstash-conf-file/152954/3 "2018-10-31T15:54:47Z")
Thank you **balumurari1**. It worked as per your suggestions. 👍🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 3:54pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-logstash-conf-file/152954/4 "2018-11-28T15:54:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.