# Logstash not sending logs to elastic search **URL:** \ **Category:** Logstash\ **Created:** [October 16, 2016, 4:59am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120 "2016-10-16T04:59:54Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\ **Post date:** [October 16, 2016, 4:59am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/1 "2016-10-16T04:59:54Z")
CentOS Linux release 7.2.1511 (Core) Using the latest Logstash and ES versions: ``` Name : elasticsearch Arch : noarch Version : 2.4.0 Release : 1 Name : logstash Arch : noarch Epoch : 1 Version : 2.4.0 Release : 1 ``` I have a 2 node ES cluster. The nodes are bound to their NICs IP in the config file (10.1.1.1, and 10.1.1.2 for the other node): network.host: 10.1.1.1 Curling 10.1.1.1:9200 successfully responds with ES cluster info. ``` "cluster_name": "mycluster", "status": "green", "timed_out": false, "number_of_nodes": 2, "number_of_data_nodes": 2, "active_primary_shards": 0, "active_shards": 0, "relocating_shards": 0, "initializing_shards": 0, "unassigned_shards": 0, "delayed_unassigned_shards": 0, "number_of_pending_tasks": 0, "number_of_in_flight_fetch": 0, "task_max_waiting_in_queue_millis": 0, "active_shards_percent_as_number": 100 ``` Installed logstash on one of the nodes.[Following this tutorial](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-grok-filter) with the example log data they provide. Used the same config file in the tut but replaced "localhost" with "10.1.1.1" I see this output with no errors: ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e13940b160fb3af3c6b33a0364ecfd4e0f4728ee.PNG) ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d33d1a438de91d455e4e67d9aa24d811c96d55c9.PNG) When I look at the the ES nodes I see no indexes have been created (checking with `10.1.1.1:9200/_cat/indices?v`) THere are no logs in /var/log/logstash The es logs in /var/log/elasticsearch aren't touched or changed after running this command running the log stash command with --verbose doesn't show any errors, just messages about loading filters, then just sits at "pipeline main started" and outputs nothing. Stopped the firewalld service, but still nothing ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 16, 2016, 5:29am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/2 "2016-10-16T05:29:51Z")
What's your LS config look like though? Also please don't post pictures of text, they are difficult to read and some people may not be even able to see them 🙂 ---
**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\ **Post date:** [October 16, 2016, 5:34am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/3 "2016-10-16T05:34:38Z")
Figured out the issue. Ok so this issue was that I specified the direct path of the log file (not \*.log as show in the screen shot). According to the tutorial (and file plugin docs), specifying start\_position =\> 0 and ignore\_older =\> 0 should suck in the log file and any pre existing data in it, but it was not doing that. If I started the logstash process and pushed new data into the log file with echo \>\> logstash finally pushing data into elasticsearch. So my question is why does it not process the log's pre-existing data when specifying the direct path of a log file? Why is \*.log necessary for it to grab the pre existing data? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 16, 2016, 5:46am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/4 "2016-10-16T05:46:58Z")
What does the config you used look like? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 16, 2016, 3:44pm UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/5 "2016-10-16T15:44:02Z")
> start\_position =\> 0 That's not a valid value for that option. It should be either "beginning" or "end". > So my question is why does it not process the log's pre-existing data when specifying the direct path of a log file? Why is \*.log necessary for it to grab the pre existing data? What probably happened here was that Logstash was tailing the file, and when you changed the filename pattern to a wildcard the sincedb path changed. With an empty sincedb file `start_position => beginning"` will actually result in the file being read from the beginning. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120/6 "2017-07-06T04:34:03Z")