# Logstash not indexing data
**URL:** https://discuss.elastic.co/t/logstash-not-indexing-data/49093
**Category:** Logstash
**Created:** [May 3, 2016, 6:00pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093 "2016-05-03T18:00:27Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dhy3ives](https://discuss.elastic.co/u/dhy3ives)
#### Post date: [May 3, 2016, 6:00pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/1 "2016-05-03T18:00:27Z")
Trying input some log files into my elastic+logstash+kibana, but i have some problems.
I make my pattern in [http://grokdebug.herokuapp.com](http://grokdebug.herokuapp.com), in the web test all works perfect, but when i run the logstash the server not work.
Below the logstash log after execute , not show anything.
**My input file is in this sintaxe:**
**May 01 13:26:23 - denyhosts : INFO new denied hosts: ['185.103.252.233']**
**May 01 14:19:26 - denyfileutil: INFO purging entries older than: Sun Apr 3 14:19:26 2016**
**May 01 14:19:26 - denyfileutil: INFO num entries purged: 0**
I want get only denyhosts tag.
**This is my patterns created:**
**DATAFULL %{MONTH} %{MONTHDAY} %{TIME}**
**INFO ( - denyhosts : INFO )**
**DENY (new denied hosts: )**
**GETIP ([(?[^]]\*)])**
This is my logstash config to execute
> input {
> file {
> path =\> "/home/elk/denyhosts.txt"
> #type =\> "denyhosts"
> start\_position =\> "beginning"
> }
> }
> filter{
> grok {
> #match =\> { "message" =\> "%{DATAFULL}%{INFO}%{DENY}%{GETIP}"}
> tag\_on\_failure =\> ["failedPattern"]
> patterns\_dir =\> "/home/elk/dennyHosts"
> }
> geoip {
> source =\> "IPBLOCK"
> }
> }
> output {
> elasticsearch {}
> stdout { codec =\> rubydebug }
> }
Using:
- Linux Ubuntu 14
- JDK 1.8
- elasticsearch-2.3.2
- kibana-4.5.0-linux-x64
- logstash-2.3.2
Some can help-me ?
Thanks
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 4, 2016, 12:45am UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/2 "2016-05-04T00:45:03Z")
> [@dhy3ives](#):
>
> when i run the logstash the server not work.
What does this mean exactly?
Also, why not just use existing patterns rather than creating your own?
---
### Author:  [@dhy3ives](https://discuss.elastic.co/u/dhy3ives)
#### Post date: [May 4, 2016, 11:22am UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/3 "2016-05-04T11:22:10Z")
Hi warkolm.
> when i run the logstash the server not work.
After execute logstash nothing is displayed in kibana or in logstash verbose log.
About my pattern, was created with existing demos, only adpted for my demand
---
### Author:  [@jclose](https://discuss.elastic.co/u/jclose)
#### Post date: [May 4, 2016, 3:03pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/4 "2016-05-04T15:03:36Z")
Can you expand those patterns out into the grok, to see if you can make any progress there?
You might also try a pattern at a time. So get the DATAFULL piece working (%{DATAFULL}.\*). And then work through each pattern.
---
### Author:  [@dhy3ives](https://discuss.elastic.co/u/dhy3ives)
#### Post date: [May 4, 2016, 3:34pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/5 "2016-05-04T15:34:00Z")
Hi Jclose.
I will be test your solution..
One question:
For example i run now the logstashDemo.conf and generated de indexes **xxx** in elastic, if i run again the same logstashDemo.conf, elastic will indentify that have the indexes and not will indexes again? Or a new indexes will generated?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093/6 "2017-07-06T04:59:23Z")