# No data from logfile on a new index

**URL:** <https://discuss.elastic.co/t/no-data-from-logfile-on-a-new-index/371998>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [December 15, 2024, 11:16pm UTC](https://discuss.elastic.co/t/no-data-from-logfile-on-a-new-index/371998 "2024-12-15T23:16:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![moep](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@moep](https://discuss.elastic.co/u/moep)\
**Post date:** [December 15, 2024, 11:16pm UTC](https://discuss.elastic.co/t/no-data-from-logfile-on-a-new-index/371998/1 "2024-12-15T23:16:35Z")

</div>

Hello,

I have running the ELK Stack in a Docker-compose setup.  
thats my setup:

```auto
  ~/local-ELK/logstash   main  pwd 
/home/moep/local-ELK/logstash

```

Thats my filter in `/home/moep/local-ELK/logstash/pipeline/weechat.conf`

```auto
input {
  file {
    path => "/usr/share/logstash/mainlog.log/test.weechatlog" 
    start_position => "beginning"         
    sincedb_path => "/dev/null"          
  }
}

filter {
  grok {
    match => {
      "message" => [
        # chat messages
        "^%{DATESTAMP:timestamp} +--> +%{USERNAME:user}: %{GREEDYDATA:message}",
        "^%{DATESTAMP:timestamp} +<-- +%{USERNAME:user}: %{GREEDYDATA:message}",
        # system calls
        "^%{DATESTAMP:timestamp} +-!\\- +%{GREEDYDATA:event}"
      ]
    }
  }

  date {
    match => ["timestamp", "YYYY-MM-dd HH:mm:ss"]
    timezone => "UTC"
  }

  mutate {
    add_field => {
      "source" => "weechat"
    }
  }
}
output {
  #stdout { codec => rubydebug } 
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]  
    user => "kibana"
    password => "3last1c"
    index => "weechat_index"
  }
}

```

When I use in Kibana the Web Dev Tools and talk directly to the `index_weechat`, I get as feedback, that it exists.  
But my new index is empty. Whats my problem?

thx

---

<div class="post-metadata">

**Author:** ![moep](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@moep](https://discuss.elastic.co/u/moep)\
**Post date:** [December 17, 2024, 8:48pm UTC](https://discuss.elastic.co/t/no-data-from-logfile-on-a-new-index/371998/2 "2024-12-17T20:48:45Z")

</div>

I solved the problem:  
First I had an error, that my ES died. the reason was wrong file permission, so I made `chmod -R 1000:1000` on `local-ELK/elasticsearch/data`.  
After that I noticed, that in my output part are multiple errors:

```auto
output {
  #stdout { codec => rubydebug } 
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]  
    user => "kibana"
    password => "3last1c"
    index => "weechat_index"
  }

```