# Logstash not showing any output (SOLVED)
**URL:** https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636
**Category:** Logstash
**Created:** [September 3, 2015, 6:40pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636 "2015-09-03T18:40:19Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 6:40pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/1 "2015-09-03T18:40:19Z")
I'm starting off with Logstash, working through the tutorials. I find the plugin documentation very lacking for someone with no experience with logstash. Here is the config file I am starting with:
```
input {
file {
path => "/Users/brad/Workspaces/unirisk.python/logstash/files/perflog.csv"
start_position => beginning
}
}
output {
stdout { }
}
```
I am running logstash on a Macbook Pro, version 1.5.4, installed via homebrew. My startup is:
```
logstash -f test.conf
```
This simply results in:
```
Logstash startup completed
```
I should be seeing the lines from my CSV file (right?). But nothing. What am I missing? Do I need to install the input file plugin? I notice that `plugin list` shows no installed plugins. I try installing by:
```
sudo plugin install logstash-input-file
```
but I get the following:
```
-> Installing logstash-input-file...
Trying https://github.com/null/logstash-input-file/archive/master.zip...
Failed to install logstash-input-file, reason: failed to download out of all possible locations..., use --verbose to get detailed information
```
Confused and stuck.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 3, 2015, 7:29pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/2 "2015-09-03T19:29:59Z")
By default Logstash will tail files. With `start_position => beginning` it will indeed read files from the beginning but only files that it hasn't seen before. I'm guessing that Logstash for some reason thinks it has seen and processed your perflog.csv and that it's now waiting for additional data to be appended to it. [A recent pull request](https://github.com/logstash-plugins/logstash-input-file/pull/61) adds more documentation about how the file input plugin works, including information about how to reset the state information that Logstash keeps so that it actually starts from the beginning.
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 7:44pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/3 "2015-09-03T19:44:30Z")
Thanks. I found a couple of `~/.sincedb*` files and removed them. When I reran logstash there is still no output.
Is the file input plugin included by default? Do I need to install it? There are no errors when I run logstash, so guessing not.
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 7:49pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/4 "2015-09-03T19:49:44Z")
Doing something so simple is indeed very frustrating and does not make logstash very appealing. I've already written a python script to process the file.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 3, 2015, 7:54pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/5 "2015-09-03T19:54:30Z")
That's odd. Start Logstash with `-v` to get verbose log output. It should tell you if it has any problems opening the file (e.g. permission problems or a typo in the filename pattern). Otherwise it'll tell you what sincedb file it uses and what the current file offset is.
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 8:08pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/6 "2015-09-03T20:08:47Z")
Seems odd. Here is what I get:
```
logstash -f ./test.conf -v
```
Output:
```
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/aws", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/bro", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/firewalls", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/grok-patterns", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/haproxy", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/java", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/junos", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/linux-syslog", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/mcollective", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/mcollective-patterns", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/mongodb", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/nagios", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/postgresql", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/rails", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/redis", :level=>:info}
Grok loading patterns from file {:path=>"/usr/local/Cellar/logstash/1.5.4/libexec/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/ruby", :level=>:info}
Registering file input {:path=>["/Users/brad/Workspaces/unirisk.python/logstash/files/*.csv"], :level=>:info}
No sincedb_path set, generating one based on the file path {:sincedb_path=>"/Users/brad/.sincedb_1f52c18f93dfb3a2d1e9d32a99f75566", :path=>["/Users/brad/Workspaces/unirisk.python/logstash/files/*.csv"], :level=>:info}
Pipeline started {:level=>:info}
Logstash startup completed
```
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 8:12pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/7 "2015-09-03T20:12:21Z")
Even specifically naming the file gives the same result - no output.
```
Registering file input {:path=>["/Users/brad/Workspaces/unirisk.python/logstash/files/perflog.csv"], :level=>:info}
No sincedb_path set, generating one based on the file path {:sincedb_path=>"/Users/brad/.sincedb_2b825ae5328f34901ed3c365067fcac8", :path=>["/Users/brad/Workspaces/unirisk.python/logstash/files/perflog.csv"], :level=>:info}
Pipeline started {:level=>:info}
Logstash startup completed
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 3, 2015, 8:39pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/8 "2015-09-03T20:39:24Z")
Hmm. Okay. What's in the sincedb file? If you delete it again and enable verbose logging with `--debug`, what does it say? The relevant code starts at [tail.rb:143](https://github.com/jordansissel/ruby-filewatch/blob/v0.6.5/lib/filewatch/tail.rb#L143).
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 9:59pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/9 "2015-09-03T21:59:55Z")
Thanks for trying to help me figure this out.
Contents of the .sincedb file:
```
cat .sincedb_2b825ae5328f34901ed3c365067fcac8
14346855 1 4 0
```
The debug is too long for a single post. Here is a link to the output via Evernote:
[Logstash debug output](https://www.evernote.com/l/ABM-Tn1h_AxEBYiRxYb4P4a1-k1oIbEkx0s)
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 3, 2015, 10:49pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/10 "2015-09-03T22:49:29Z")
I figured out the problem with plugins. I had elasticsearch installed too, which has a "plugin" in the path. I was inadvertently running the wrong plugin. Running the logstash version of plugin revealed that all the plugins were already installed.
Just for grins, I removed the homebrew installs of logstash, elasticsearch, & kibana. Then subsequently installed these manually from fresh downloads. Unfortunately, I'm having exactly the same problem. Nothing is jumping out at me in the debug file. Hmmm....
EDIT: This is crazy. I changed the output to:
```
output {
file {
path => "/Users/brad/test.txt"
}
}
```
The output file does not get created. I also tried running logstash as sudo, but still no output.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 4, 2015, 2:04am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/11 "2015-09-04T02:04:48Z")
Try;
```auto
input {
stdin {}
}
```
And then cat the file into LS - `cat /Users/brad/Workspaces/unirisk.python/logstash/files/perflog.csv | logstash -f test/conf`.
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 4, 2015, 2:15am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/12 "2015-09-04T02:15:57Z")
No output.
```
cat files/perflog.csv | logstash -f files/test2.conf -v
Pipeline started {:level=>:info}
Plugin is finished {:plugin=>false, codec=>"UTF-8">>, :level=>:info}
Logstash startup completed
Plugin is finished {:plugin=>"UTF-8">, workers=>1>, :level=>:info}
Pipeline shutdown complete. {:level=>:info}
Logstash shutdown completed
```
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 4, 2015, 2:30am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/13 "2015-09-04T02:30:47Z")
I manually installed logstash on my mint virtual machine. Used the stdin and stdout version of the config file. No output. Exactly the same result. This has to be some sort of bug in logstash.
```
cat files/perflog.csv | logstash -f files/test2.conf -v
Pipeline started {:level=>:info}
Plugin is finished {:plugin=>false, codec=>"UTF-8">>, :level=>:info}
Logstash startup completed
Plugin is finished {:plugin=>"UTF-8">, workers=>1>, :level=>:info}
Pipeline shutdown complete. {:level=>:info}
Logstash shutdown completed
```
---
### Author:  [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)
#### Post date: [September 4, 2015, 2:38am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/14 "2015-09-04T02:38:28Z")
Either logstash is majorly messed up or I'm missing something really basic. For completeness I downloaded version 1.4.2. Same result.
EDIT 1:
I cannot reply any longer due to a daily limit. Here is the config:
```
input {
stdin {}
}
output {
stdout {}
}
```
EDIT 2: Still cannot reply due to daily limit
**Problem solved!** It turns out my first logfile I am testing with is using old style line endings. This was no problem for my python program processing the CSV file, no problem for sublime or intellij. No problem even for Microsoft Excel running on my Mac. But `cat` didn't like it, and neither did logstash.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 4, 2015, 2:43am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/15 "2015-09-04T02:43:50Z")
Can we see your entire config?
---
### Author:  [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)
#### Post date: [February 26, 2016, 3:58pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/16 "2016-02-26T15:58:10Z")
I know this is a really old post - but like to contribute back. But I had the same issue. I was able to solve it for my part.
Putting in debug mode I was able to get an important message:
\_discover\_file: /Users/wtaylor/Downloads/logstash-2.2.2/bin/Wayne.csv: skipping because it was last modified more than 86400.0 seconds ago {:level=\>:debug, :file=\>"filewatch/watch.rb", :line=\>"310", :method=\>"\_discover\_file"}
Pushing flush o
When I touched the log file I was reading in boom data started to process
---
### Author:  [@guojingjing](https://discuss.elastic.co/u/guojingjing)
#### Post date: [March 3, 2016, 7:53am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/17 "2016-03-03T07:53:01Z")
> [@Wayne\_Taylor](#):
>
> because it was last modified more than 86400.0 seconds ago
does this mean the file was created too long ago?
I'm having similar issues: deal with old files and a lot of them. And so is there any way to change this "86400 second" limitation?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 3, 2016, 8:20am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/18 "2016-03-03T08:20:44Z")
> does this mean the file was created too long ago?
No, it means the file was _modified_ too long ago.
> I'm having similar issues: deal with old files and a lot of them. And so is there any way to change this "86400 second" limitation?
> **[File input plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-ignore_older)**
---
### Author:  [@sarbjeet](https://discuss.elastic.co/u/sarbjeet)
#### Post date: [April 25, 2016, 7:18am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/19 "2016-04-25T07:18:19Z")
hi...
when i run logstash config file .it display output but when we run it again then no output displayed.
its new for me.
i installed logstash 2.2,elasticsearch 2.2 and kibana 1.4.
plz reply soon .its urgent.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 25, 2016, 7:20am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636/20 "2016-04-25T07:20:01Z")
Please start a new thread.
[Next page](https://discuss.elastic.co/t/logstash-not-showing-any-output-solved/28636.md?page=2)