# Logstash is taking more time or hanging

**URL:** https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469
**Category:** Logstash
**Created:** [January 6, 2016, 6:30am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469 "2016-01-06T06:30:19Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![amgowda](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@amgowda](https://discuss.elastic.co/u/amgowda)
#### Post date: [January 6, 2016, 6:30am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/1 "2016-01-06T06:30:19Z")

</div>

Kibana is not showing any drop-down value in 'Time-filed name'  
RedHat Linux 64 bit, software installed using RPM package  
java -version  
java version "1.8.0\_66"  
Java(TM) SE Runtime Environment (build 1.8.0\_66-b17)  
Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode)

## Logstash: 2.2.1 Elasticsearch: 2.2.1 Kibana: 4.3.1

## log [11:52:15.173] [info][status][plugin:kibana] Status changed from uninitialized to green - Ready log [11:52:15.198] [info][status][plugin:elasticsearch] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [11:52:15.209] [info][status][plugin:kbn\_vislib\_vis\_types] Status changed from uninitialized to green - Ready log [11:52:15.217] [info][status][plugin:markdown\_vis] Status changed from uninitialized to green - Ready log [11:52:15.222] [info][status][plugin:metric\_vis] Status changed from uninitialized to green - Ready log [11:52:15.225] [info][status][plugin:spyModes] Status changed from uninitialized to green - Ready log [11:52:15.228] [info][status][plugin:statusPage] Status changed from uninitialized to green - Ready log [11:52:15.230] [info][status][plugin:table\_vis] Status changed from uninitialized to green - Ready log [11:52:15.248] [info][listening] Server running at [http://0.0.0.0:5601](http://0.0.0.0:5601) log [11:52:15.258] [info][status][plugin:elasticsearch] Status changed from yellow to green - Kibana index ready

sudo service elasticsearch start  
Starting elasticsearch: [OK]

sudo service elasticsearch status  
elasticsearch (pid 24984) is running...

## curl localhost:9200 { "name" : "Patch", "cluster\_name" : "elasticsearch", "version" : { "number" : "2.1.1", "build\_hash" : "40e2c53a6b6c2972b3d13846e450e66f4375bd71", "build\_timestamp" : "2015-12-15T13:05:55Z", "build\_snapshot" : false, "lucene\_version" : "5.3.1" }, "tagline" : "You Know, for Search" }

## sudo service elasticsearch stop Stopping elasticsearch: [OK]

cat /etc/logstash/conf.d/10-syslog.conf  
input  
{  
stdin { }  
}  
output  
{  
elasticsearch  
{  
hosts =\> "bhlnxbimsv01:9200"  
}  
stdout  
{  
codec =\> rubydebug  
}  
}

* * *

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 6, 2016, 6:34am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/2 "2016-01-06T06:34:48Z")

</div>

> [@amgowda](#):
>
> Kibana is not showing any drop-down value in 'Time-filed name'

What do you mean, can you share a screenshot?

---

<div class="post-metadata">

### Author: ![amgowda](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@amgowda](https://discuss.elastic.co/u/amgowda)
#### Post date: [January 6, 2016, 6:41am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/3 "2016-01-06T06:41:23Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/2X/f/fb9d2c6c8824d7be5d6a529313930ed0d0637ada.png)

Elasticsearch URL output:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/730b0fc5af0e49778f61f3e008f3a03366112f02.png)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 6, 2016, 6:42am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/4 "2016-01-06T06:42:43Z")

</div>

Do you have data in the cluster?

---

<div class="post-metadata">

### Author: ![amgowda](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@amgowda](https://discuss.elastic.co/u/amgowda)
#### Post date: [January 6, 2016, 6:46am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/5 "2016-01-06T06:46:47Z")

</div>

Hi Mark,

I am new to ELK, so I just installed below software in Linux RedHat machine:  
Java, Elasticsearch, Logstash (RPM packages) & Kibana (Untar the TAR bundle)

Started all process with sample logstash conf file.

Do I miss anything? What is meaning of Data in cluster?

Please guide me or share me any doc which helps me

Thanks in advance  
Adarsha

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 6, 2016, 6:50am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/6 "2016-01-06T06:50:34Z")

</div>

Kibana can only display something if there is data in ES.

Take a look at [https://www.elastic.co/guide/en/kibana/current/getting-started.html](https://www.elastic.co/guide/en/kibana/current/getting-started.html)

---

<div class="post-metadata">

### Author: ![amgowda](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@amgowda](https://discuss.elastic.co/u/amgowda)
#### Post date: [January 6, 2016, 6:52am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/7 "2016-01-06T06:52:37Z")

</div>

Thanks Mark, will go through and let you know if there is any issue

---

<div class="post-metadata">

### Author: ![amgowda](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@amgowda](https://discuss.elastic.co/u/amgowda)
#### Post date: [January 7, 2016, 8:06am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/8 "2016-01-07T08:06:44Z")

</div>

Hi Mark,

Logstash is taking more time or hanging, even file contain single line data.

cat conf/emp.conf  
input {  
file {  
path =\> "/opt/log\_files/emp.log"  
start\_position =\> beginning  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

cat emp.log  
adarsha 12345678

bin/logstash -f conf/emp.conf  
Settings: Default filter workers: 4  
Logstash startup completed

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 7, 2016, 8:31am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/9 "2016-01-07T08:31:06Z")

</div>

It's not hanging, if you have processed that file before then look at [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb\_path](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469/10 "2017-07-06T05:16:34Z")

</div>


