# Logstash missing event when output set to elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153>\
**Category:** Logstash\
**Created:** [September 20, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153 "2017-09-20T11:10:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bns\_frankpoon](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@bns\_frankpoon](https://discuss.elastic.co/u/bns_frankpoon)\
**Post date:** [September 20, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153/1 "2017-09-20T11:10:52Z")

</div>

Hi,

I'm trying the elk stack for analyze and visualize data. I tried to configure logstash for standard output and elastisearch. If I only output to screen, it shows 5 records, perfect. If I set the output to elasticsearch, the outcome sometimes is 3, 4, which is not the exactly the same as what I input. I tried to search in google / forum, but didn't find any solution.

Sample config and data show as below:

sample.json  
{"ID":"ABCDEFA"}  
{"ID":"ABCDEFB"}  
{"ID":"ABCDEFC"}  
{"ID":"ABCDEFD"}  
{"ID":"ABCDEFE"}

sample.config:

input {

file {  
codec =\>"json"  
path =\> ["/data/sample/user/sample.json"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "ycp-dashboard-sample-user"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-missing-event-when-output-set-to-elasticsearch/101153/2 "2017-10-18T11:11:19Z")

</div>

Closed on October 18, 2017, 11:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.