# Logstash not writing to ElasticSearch

**URL:** <https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch/162696>\
**Category:** Logstash\
**Created:** [January 2, 2019, 5:37pm UTC](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch/162696 "2019-01-02T17:37:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mad](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mad](https://discuss.elastic.co/u/mad)\
**Post date:** [January 2, 2019, 5:37pm UTC](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch/162696/1 "2019-01-02T17:37:58Z")

</div>

I am using the following -\> filebeat-\>logstash-\>elasticsearch  
I am getting 2 types of logs, Apache and Log4J, and trying to create different indexes

> output {  
> if [flow] == "apache" {  
> elasticsearch {  
> hosts =\> ["xx.xx.xx.xx:9200"]  
> index =\> "apachelogs-%{+YYYY.MM.dd}"  
> }  
> }  
> else if [flow] == "log4j" {  
> elasticsearch {  
> hosts =\> ["xx.xx.xx.xx:9200"]  
> index =\> "jbosslogs-%{+YYYY.MM.dd}"  
> }  
> }  
> }

Does not create any indexes in Elasticsearch, however, there are no errors in logstash or Elasticsearch that I can see.  
My filebeats.yml file reads like this

> - type: log

Everything was working fine till I added the fork on the output section.  
Can anyone suggest what could be the reason? Or something that I am doing wrong above

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 2, 2019, 5:55pm UTC](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch/162696/2 "2019-01-02T17:55:16Z")

</div>

During development it often helps to output events to stdout with the rubydebug codec so you can look at the structure. If you have indented your Filebeat config file correctly (hard to tell given the formatting) I believe the field should end up under `[fields][flow]` and not `[flow]`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2019, 5:55pm UTC](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch/162696/3 "2019-01-30T17:55:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.