Logstash won't create index in ES

[magnusbaeck (Magnus Bäck)]

@bluethundr

Started up elasticsearch and started up logstash on the command line using this line:

logstash -e 'input { stdin { } } output { elasticsearch { host => localhost } }'

And lo and behold!!! LS is now able to create indexes in ES!!

#curl http://localhost:9200/_cat/indices
red open .kibana             1 1
red open logstash-2015.06.24 5 1

Yes, but why is the cluster red? Did you issue the _cat/indices RPC immediately after the index was created? After creating an index the cluster should go yellow within a second or two.

@bluethundr

So easy right? Well not quite. Because, if I go back into the yaml file and alter one parameter. Only ONE parameter, it stops working again. If I try to change the cluster name to:

cluster.name: jokefire

Fired logstah back up and got this error:

Yes, because Logstash by default attempts to join a cluster named "elasticsearch" (see the documentation of the cluster parameter) and when you rename the cluster Logstash won't find any cluster with that name to connect to. Make sure ES and LS agree on the cluster name, or make Logstash use HTTP instead with protocol => http.

[bluethundr (Tim Dunphy)]

Yes, but why is the cluster red? Did you issue the _cat/indices RPC immediately after the index was created? After creating an index the cluster should go yellow within a second or two.

Yep. You're right. It was red because I curled the indexes a little too quickly. I started from scratch with the default yaml file, plus I added one more node.

green open .kibana             1 1 2 0  9.5kb  4.8kb
green open logstash-2015.06.24 5 1 7 0 38.2kb 19.2kb

So, I'm all good there now.

Yes, because Logstash by default attempts to join a cluster named "elasticsearch" (see the documentation of the cluster parameter) and when you rename the cluster Logstash won't find any cluster with that name to connect to. Make sure ES and LS agree on the cluster name, or make Logstash use HTTP instead with protocol => http.

Ok that makes sense. Is there an easy way to get LS to look for a different cluster name? One of my choosing? Or maybe just using http mode would be easier.

Thanks

[magnusbaeck (Magnus Bäck)]

Is there an easy way to get LS to look for a different cluster name?

Yes, see the cluster parameter whose documentation I linked to.

[bluethundr (Tim Dunphy)]

Ok, thanks! I'll check it out.

[UsreTX (Josh Usre)]

I seem to be having a similar issue. Fresh install of all the latest from that tutorial, and logstash isn't creating indexes. help

[warkolm (Mark Walkom)]

Please start your own thread for this