# Logstash seems successful. but nothing found on elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-seems-successful-but-nothing-found-on-elasticsearch/83484
**Category:** Logstash
**Created:** [April 25, 2017, 3:33am UTC](https://discuss.elastic.co/t/logstash-seems-successful-but-nothing-found-on-elasticsearch/83484 "2017-04-25T03:33:51Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sraghu1980](https://discuss.elastic.co/u/sraghu1980)
#### Post date: [April 25, 2017, 3:33am UTC](https://discuss.elastic.co/t/logstash-seems-successful-but-nothing-found-on-elasticsearch/83484/1 "2017-04-25T03:33:51Z")
Hi,
I have /etc/logstash/conf.d/logstash.conf:
input {
file {
path =\> "/var/lib/collectd/csv/Gateway/cpu-0/cpu-idle-2017-04-24"
start\_position =\> beginning
sincedb\_path =\> "/dev/null"
ignore\_older =\> 0
}
}
filter {
csv {
separator =\> ","
#epoch,value
columns =\> ["EPOCH","VALUE"]
}
}
output {
elasticsearch {
hosts =\> "localhost:9200"
action =\> "index"
index =\> "cpu0\_utilization"
}
stdout { codec =\> rubydebug }
}
sudo service logstash restart
sudo service elasticsearch restart
/opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -v ===\> Displays something similar to
{
"message" =\> "1493090576.255,93.400394",
"@version" =\> "1",
"@timestamp" =\> "2017-04-25T03:22:56.811Z",
"path" =\> "/var/lib/collectd/csv/Gateway/cpu-0/cpu-idle-2017-04-24",
"host" =\> "raghu-OptiPlex-9020",
"EPOCH" =\> "1493090576.255",
"VALUE" =\> "93.400394"
}
For elasticsearch:
curl localhost:9200
{
"name" : "Wiz Kid",
"cluster\_name" : "Gateway",
"cluster\_uuid" : "6iIoakzRRr6VM5Zd8QM6xw",
"version" : {
"number" : "2.4.4",
"build\_hash" : "fcbb46dfd45562a9cf00c604b30849a6dec6b017",
"build\_timestamp" : "2017-01-03T11:33:16Z",
"build\_snapshot" : false,
"lucene\_version" : "5.5.2"
},
"tagline" : "You Know, for Search"
}
Nothing is seen in elastic search:
curl -X GET localhost:9200/cpu0\_utilization
{"cpu0\_utilization":{"aliases":{},"mappings":{"logs":{"properties":{"@timestamp":{"type":"date","format":"strict\_date\_optional\_time||epoch\_millis"},"@version":{"type":"string"},"EPOCH":{"type":"string"},"VALUE":{"type":"string"},"host":{"type":"string"},"message":{"type":"string"},"path":{"type":"string"}}}},"settings":{"index":{"creation\_date":"1493090457803","uuid":"Av7GmdHlSD-QVWFfB\_aGyw","number\_of\_replicas":"0","number\_of\_shards":"1","version":{"created":"2040499"}}},"warmers":{}}}
I created index using: curl -X POST 'localhost:9200/cpu0\_utilization'
I have following doubts.
1. Can't logstash create index based on options provided in logstash.conf ?
2. Is it neccessary to run always run: /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -v
3. Is there a option in logstash to configure it to pick .csv from different machine? as my csv file is in different machine.
4. How do I verify contents of elasticsearch?
5. kibana says: log [20:20:24.592] [info][status][plugin:elasticsearch] Status changed from yellow to green - Kibana index ready
whereas elasticsearch says:
[2017-04-24 20:20:21,887][INFO][cluster.routing.allocation] [Wiz Kid] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.kibana][0]] ...]).
[2017-04-24 20:20:57,816][INFO][cluster.metadata] [Wiz Kid] [cpu0\_utilization] creating index, cause [api], templates [], shards [1]/[0], mappings []
[2017-04-24 20:20:58,054][INFO][cluster.routing.allocation] [Wiz Kid] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[cpu0\_utilization][0]] ...]).
[2017-04-24 20:21:06,509][INFO][cluster.metadata] [Wiz Kid] [cpu0\_utilization] create\_mapping [logs]
Can both of them be in different state YeLLOW and Green?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 25, 2017, 6:19am UTC](https://discuss.elastic.co/t/logstash-seems-successful-but-nothing-found-on-elasticsearch/83484/2 "2017-04-25T06:19:26Z")
> Can't logstash create index based on options provided in logstash.conf ?
Sure it can.
> Is it neccessary to run always run: /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -v
What do you mean? With the exception of the `-v` option that's a normal Logstash startup command, although one usually passes the path to the conf.d directory so that Logstash reads all files in the directory.
> Is there a option in logstash to configure it to pick .csv from different machine? as my csv file is in different machine.
Then you need to use NFS or a similar network file system to mount from the other machine. Logstash can't magically read files from other computers.
> How do I verify contents of elasticsearch?
Kibana for example, or one of the many low-level REST APIs that Elasticsearch has.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 23, 2017, 6:29am UTC](https://discuss.elastic.co/t/logstash-seems-successful-but-nothing-found-on-elasticsearch/83484/3 "2017-05-23T06:29:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.