Hi there,
I've been working with ELK 7.1 and 7.2 for employee testing purposes and there have been numerous instances where people are getting stuck at:
[INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
and having no data ingesting into elasticsearch indexes
After hours of debugging with a colleague, we have found that the issue is related to the line break type for the CSV files we're ingesting. Once the file is saved as Unix (LF) the file ingests as normal.
I first noticed this in version 7.0 when I did my employee testing and I'm raising this issue now since it hasn't been fixed as of version 7.2
The weird part is that this only happens to some people who do our employee test (install ELK - ingest csv - make visuals)
OS: Windows 10
Steps to reproduce:
-Download the latest versions of Elastic, Logstash and Kibana (in this case 7.2)
-Follow the steps in the downloads (so run the .bat files)
-Ensure both elastic and kibana are running.
-Make a conf file for a csv file (one that you know works)
-Check (notepad++) if the line breaks in the csv are windows (CR LF)
-Run Logstash with the config file.
-If nothing appears in elastic indices then go back to the csv and save it now as unix (LF)
-rerun logstash with the same conf
-index will now appear in elastic.
Everything done above is using the default .yml configurations
so localhost:9200 etc
Please let me know what you guys at elastic and the community think.
-Kavs