# Logstash tutorial: index\_not\_found\_exception \[SOLVED\]

**URL:** <https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786>\
**Category:** Logstash\
**Created:** [March 8, 2016, 2:31pm UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786 "2016-03-08T14:31:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\
**Post date:** [March 8, 2016, 2:31pm UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786/1 "2016-03-08T14:31:33Z")

</div>

Hello,

I am following the [Logstash tutorial](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html). This command

```
curl -XGET '192.168.77.200:9200/logstash-2016.03.08/_search?q=response=200'

```

returns the following error, instead of the data shown in the tutorial:

> {"error":{"root\_cause":[{"type":"index\_not\_found\_exception","reason":"no such index","index":"logstash-2016.03.08","resource.type":"index\_or\_alias","resource.id":"logstash-2016.03.08"}],"type":"index\_not\_found\_exception","reason":"no such index","index":"logstash-2016.03.08","resource.type":"index\_or\_alias","resource.id":"logstash-2016.03.08"},"status":404}

Elasticsearch is running correctly on the host 192.168.77.200. This is the content of `first-pipeline.conf` as indicated by the tutorial:

```
input {
    file {
        path => "/opt/logstash/logstash-tutorial.log"
        start_position => beginning
    }
}

filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}

output {
    elasticsearch {
        hosts => ["192.168.77.200:9200"]
    }
    stdout {}
}

```

and the Logstash process is run, as indicated, as

```
bin/logstash -f first-pipeline.conf

```

What is the reason for this error? Is it necessary to create an index beforehand?

Thanks in advance for any tip.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2016, 10:08pm UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786/2 "2016-03-09T22:08:26Z")

</div>

Logstash is probably ignoring logstash-tutorial.log. Maybe because it thinks is already has processed the file (in which case you can delete the sincedb file or set the file input's `sincedb_path` parameter to /dev/null) or you're running Logstash 2.2 and logstash-tutorial.log is older than 24 h (see the file input's `ignore_older` option).

---

<div class="post-metadata">

**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\
**Post date:** [March 15, 2016, 10:15am UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786/3 "2016-03-15T10:15:42Z")

</div>

Thanks. In fact there were a few things to fix:

- In the input section of the pipeline, we must add `sincedb_path => "/dev/null"` to tell Logstash to re-process the data, as you said.

- The source data file must not be older than 24h, as you said, so (on Linux) a `touch logstash-tutorial.log` will fix the problem.

- The filter section should include a filter to match the timestamp as extracted from the log, or otherwise Logstash will consider ~~the timestamp of the file~~ the current timestamp when it reads the file (quite useless):

- Another useful edit on the output section is to define the index name to something more meaningful:

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 15, 2016, 10:32am UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786/4 "2016-03-15T10:32:57Z")

</div>

> otherwise Logstash will consider the timestamp of the file (quite useless):

I'm pretty sure it defaults to the current timestamp when the file is read.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786/6 "2017-07-06T05:06:46Z")

</div>