# No index created

**URL:** <https://discuss.elastic.co/t/no-index-created/137410>\
**Category:** Logstash\
**Created:** [June 26, 2018, 9:55am UTC](https://discuss.elastic.co/t/no-index-created/137410 "2018-06-26T09:55:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![retxedue](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@retxedue](https://discuss.elastic.co/u/retxedue)\
**Post date:** [June 26, 2018, 9:55am UTC](https://discuss.elastic.co/t/no-index-created/137410/1 "2018-06-26T09:55:52Z")

</div>

I have this below logstash config. However, it is not creating any index.

file {  
type =\> "monitor1"  
path =\> "/root/Documents/scripts/data/monitor.out"  
start\_position =\> "beginning"  
sincedb\_path =\> "/opt/sincedb/.sincedb\_monitor1"  
}  
}  
filter {  
if [type] == "monitor1" {  
grok {  
match =\> { "message" =\> "hostname:%{GREEDYDATA:hostname}|ipaddress:%{IP:ipaddress}|status:%{WORD:status}" }  
}  
}  
}  
output {  
if [type] == "monitor1" {  
elasticsearch {  
hosts =\> ["1XX.XX.XX.XX:9200"]  
index =\> "monitor1"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![retxedue](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@retxedue](https://discuss.elastic.co/u/retxedue)\
**Post date:** [June 26, 2018, 9:58am UTC](https://discuss.elastic.co/t/no-index-created/137410/2 "2018-06-26T09:58:06Z")

</div>

grok filter is successful using grokdebugger and grokconstructor

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2018, 11:01am UTC](https://discuss.elastic.co/t/no-index-created/137410/3 "2018-06-26T11:01:34Z")

</div>

Standard debugging advice:

- Remove all conditionals.
- Use (only) a `stdout { codec => rubydebug }` output until you've verified that events look like you want them to. Only then add back the elasticsearch output.

---

<div class="post-metadata">

**Author:** ![retxedue](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@retxedue](https://discuss.elastic.co/u/retxedue)\
**Post date:** [June 29, 2018, 5:27am UTC](https://discuss.elastic.co/t/no-index-created/137410/6 "2018-06-29T05:27:10Z")

</div>

i have tried above. Seems i am not seeing output from my logsource.

[2018-06-29T13:24:05,083][WARN][logstash.runner] SIGTERM received. Shutting down.  
[2018-06-29T13:24:06,785][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x3b76393f@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:247 run\>"}  
[2018-06-29T13:24:06,904][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}  
[2018-06-29T13:24:06,935][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x1d813b41@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:247 sleep\>"}  
[2018-06-29T13:24:06,937][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]}  
[2018-06-29T13:24:09,157][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x1d813b41@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:247 run\>"}  
[2018-06-29T13:24:19,062][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"}  
[2018-06-29T13:24:19,066][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"}  
[2018-06-29T13:24:19,236][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2018-06-29T13:24:19,345][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.2.4"}  
[2018-06-29T13:24:19,397][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2018-06-29T13:24:19,795][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}  
[2018-06-29T13:24:19,983][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x648dc3fa@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:247 sleep\>"}  
[2018-06-29T13:24:19,994][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 29, 2018, 6:04am UTC](https://discuss.elastic.co/t/no-index-created/137410/7 "2018-06-29T06:04:46Z")

</div>

Your file input is probably tailing the file. Deleting the sincedb file while Logstash isn't running should help with that. If that doesn't help, increase Logstash's loglevel and look for log entries containing "glob".

---

<div class="post-metadata">

**Author:** ![retxedue](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@retxedue](https://discuss.elastic.co/u/retxedue)\
**Post date:** [July 3, 2018, 5:23am UTC](https://discuss.elastic.co/t/no-index-created/137410/8 "2018-07-03T05:23:52Z")

</div>

where can i increase the logstash log level?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 3, 2018, 5:57am UTC](https://discuss.elastic.co/t/no-index-created/137410/9 "2018-07-03T05:57:31Z")

</div>

In logstash.yml or via command line options. The details are described in the documentation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 5:57am UTC](https://discuss.elastic.co/t/no-index-created/137410/10 "2018-07-31T05:57:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.