# New Log file not pull up on kibana

**URL:** <https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221>\
**Category:** Logstash\
**Created:** [May 10, 2017, 10:01am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221 "2017-05-10T10:01:51Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 10, 2017, 10:01am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/1 "2017-05-10T10:01:51Z")

</div>

Hello dears,  
I have 2 types of logs, pfSense which works perfectly , and I want to add other logs (saplog) in a file.  
I already create a filter (sapfilter) for these new logs, I try it with logstash-f and that's work. When I refresh my index, 22 new fields of my sapfilter has been added.  
The problem is that the log file don't pull up on kibana. My input ran with logstash-f ... There is my input

#saprouter log files  
input {  
file {  
path =\> "/var/log/saprouterlog/saprouterlog.txt\_a\_20170509\_090647-20170509\_130347"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
type =\> "saplog"  
}  
}

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 10, 2017, 11:12am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/2 "2017-05-10T11:12:39Z")

</div>

Help my friends 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2017, 5:22am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/3 "2017-05-11T05:22:39Z")

</div>

Does the logstash user have permission to read those log files? The file itself needs to be readable and all directories leading up to the directory containing the file must be executable.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 7:43am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/4 "2017-05-11T07:43:49Z")

</div>

Actually, it works but it so long (1-2hour for one file)  
Can we do this more quickly ?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 8:35am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/5 "2017-05-11T08:35:15Z")

</div>

up up

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 8:55am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/6 "2017-05-11T08:55:29Z")

</div>

up uuuuuuuuuuuuuuuuuuuuup

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2017, 9:10am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/7 "2017-05-11T09:10:54Z")

</div>

> up uuuuuuuuuuuuuuuuuuuuup

If you're trying to annoy the people that can help you you're certainly on the right track.

> Actually, it works but it so long (1-2hour for one file)  
> Can we do this more quickly ?

Perhaps. How big are the files? What does the Logstash configuration look like? What possible bottlenecks are there?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 9:19am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/8 "2017-05-11T09:19:42Z")

</div>

Oups sorry for annoying 😕  
One file is 490Ko  
Logstash configuration is fat (3pages).

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2017, 9:57am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/9 "2017-05-11T09:57:54Z")

</div>

> 490Ko

490 kilobytes?

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 11, 2017, 10:01am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/10 "2017-05-11T10:01:23Z")

</div>

yes 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2017, 11:04am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/11 "2017-05-11T11:04:32Z")

</div>

Such a small file should be processed within seconds. The Logstash logs might contain clues about what's taking so long.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 11:06am UTC](https://discuss.elastic.co/t/new-log-file-not-pull-up-on-kibana/85221/12 "2017-06-08T11:06:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
