# No indexes, no error logs **URL:** \ **Category:** Logstash\ **Created:** [December 22, 2017, 2:37pm UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015 "2017-12-22T14:37:23Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 22, 2017, 2:37pm UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/1 "2017-12-22T14:37:24Z")
I've been trying to push logs with Logstash into 3-node elasticsearch cluster. I start logstash, logstash logs all fine, but no logs appear in ES. I've 3 nodes, both data and master-eligible nodes, and one among them is an injest node. My logstash pipeline postfix.conf: > output { > elasticsearch { > hosts =\> ["elk00-pco.easydns.vpn:9200", "elk01-pco.easydns.vpn:9200", "elk02-pco.easydns.vpn:9200"] > user =\> "logstash\_logs" > password =\> "logstash\_logs." > ssl =\> true > cacert =\> "/etc/logstash/ca.pem" > index =\> "logstash-postfix-%{+YYYY.MM.dd}" > } > stdout { codec =\> rubydebug } > } User `logstash_logs` has a role under the same name, which has privileges `monitoring`, `manage_index_templates`, and `all` privileges to `logstash-*` indices. The logstash log (some lines omitted): > [2017-12-22T13:17:43,018][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > [2017-12-22T13:17:44,673][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[https://logstash\_system:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk00-pco.easydns.vpn:9200/), [https://logstash\_system:xxxxxx@elk01-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk01-pco.easydns.vpn:9200/), [https://logstash\_system:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk02-pco.easydns.vpn:9200/)]}} > [2017-12-22T13:17:44,677][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://logstash\_system:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk00-pco.easydns.vpn:9200/), :path=\>"/"} > [2017-12-22T13:17:45,423][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[https://logstash\_system:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk02-pco.easydns.vpn:9200/)"} > [2017-12-22T13:17:45,440][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[https://elk00-pco.easydns.vpn:9200](https://elk00-pco.easydns.vpn:9200)", "[https://elk01-pco.easydns.vpn:9200](https://elk01-pco.easydns.vpn:9200)", "[https://elk02-pco.easydns.vpn:9200](https://elk02-pco.easydns.vpn:9200)"]} > [2017-12-22T13:17:45,441][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>2, :thread=\>"#\"} > [2017-12-22T13:17:45,574][INFO][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[https://logstash\_system:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk00-pco.easydns.vpn:9200/), [https://logstash\_system:xxxxxx@elk01-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk01-pco.easydns.vpn:9200/), [https://logstash\_system:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk02-pco.easydns.vpn:9200/)]}} > [2017-12-22T13:17:45,579][INFO][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://logstash\_system:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk00-pco.easydns.vpn:9200/), :path=\>"/"} > [2017-12-22T13:17:45,631][WARN][logstash.licensechecker.licensereader] Restored connection to ES instance {:url=\>"[https://logstash\_system:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_system:xxxxxx@elk00-pco.easydns.vpn:9200/)"} > [2017-12-22T13:17:45,867][INFO][logstash.pipeline] Pipeline started {"pipeline.id"=\>".monitoring-logstash"} > [2017-12-22T13:17:47,404][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[https://logstash\_logs:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk00-pco.easydns.vpn:9200/), [https://logstash\_logs:xxxxxx@elk01-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk01-pco.easydns.vpn:9200/), [https://logstash\_logs:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk02-pco.easydns.vpn:9200/)]}} > [2017-12-22T13:17:47,408][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://logstash\_logs:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk00-pco.easydns.vpn:9200/), :path=\>"/"} > [2017-12-22T13:17:47,590][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[https://logstash\_logs:xxxxxx@elk00-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk00-pco.easydns.vpn:9200/)"} > [2017-12-22T13:17:47,617][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://logstash\_logs:xxxxxx@elk01-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk01-pco.easydns.vpn:9200/), :path=\>"/"} > [2017-12-22T13:17:47,891][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[https://logstash\_logs:xxxxxx@elk01-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk01-pco.easydns.vpn:9200/)"} > [2017-12-22T13:17:47,897][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://logstash\_logs:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk02-pco.easydns.vpn:9200/), :path=\>"/"} > [2017-12-22T13:17:48,039][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[https://logstash\_logs:xxxxxx@elk02-pco.easydns.vpn:9200/](https://logstash_logs:xxxxxx@elk02-pco.easydns.vpn:9200/)"} > [2017-12-22T13:17:48,049][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} > [2017-12-22T13:17:48,057][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} > [2017-12-22T13:17:48,072][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[//elk00-pco.easydns.vpn:9200](https://elk00-pco.easydns.vpn:9200)", "[//elk01-pco.easydns.vpn:9200](https://elk01-pco.easydns.vpn:9200)", "[//elk02-pco.easydns.vpn:9200](https://elk02-pco.easydns.vpn:9200)"]} > [2017-12-22T13:17:48,276][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250, :thread=\>"#\"} > [2017-12-22T13:17:48,554][INFO][logstash.pipeline] Pipeline started {"pipeline.id"=\>"main"} > [2017-12-22T13:17:48,577][INFO][logstash.agent] Pipelines running {:count=\>2, :pipelines=\>[".monitoring-logstash", "main"]} > [2017-12-22T13:17:48,579][INFO][logstash.inputs.metrics] Monitoring License OK All checks out fine. I did get this configuration working once. Then, I ran `_all` index delete, reconfigured x-pack authentication, and now, no logs/indices are showing up in Kibana. How to track down the issue? Thanks. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 22, 2017, 3:10pm UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/2 "2017-12-22T15:10:18Z")
How do you know Logstash has events to process and send to ES? What does your input configuration look like? ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 22, 2017, 8:55pm UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/3 "2017-12-22T20:55:41Z")
@magnusbaeck _How do you know Logstash has events to process and send to ES?_ Before deleting all the index, I'd run logstash with the same pipeline config and logs had ended up in ES. Input config: > input { > file { > type =\> "postfix" #to differentiate between postfix for mx-caprica, esmtp. > path =\> "/usr/share/logstash/email\_qmgr.log" > start\_position =\> "beginning" > } > } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 23, 2017, 8:03am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/4 "2017-12-23T08:03:51Z")
I would recommend that you install X-Pack in order to enable [Logstash monitoring](https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html). This will clearly show you if any data is flowing through Logstash or not. ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 26, 2017, 8:52am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/5 "2017-12-26T08:52:28Z")
@Christian_Dahlqvist, this is the output of my monitoring section after I ran the logstash pipeline for a minute. Clearly, events were sent: [[Album] Imgur: The magic of the Internet ![](https://i.imgur.com/cE2UJoE.jpg?fb "Imgur: The magic of the Internet") ](https://imgur.com/a/tqUsa) But, when I navigate to the 'Dashboard' to view the logs, it redirects me to the 'Management' section where it says - Unable to fetch mapping of the format logstash-\* [[Album] Imgur: The magic of the Internet ![](https://i.imgur.com/HVgl4D8.jpg?fb "Imgur: The magic of the Internet") ](https://imgur.com/a/NNeCB) But, if you look at my logstash output snippet, I've clearly mentioned `index => "logstash-postfix-%{+YYYY.MM.dd}"`. What's is the issue here? Thanks. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 26, 2017, 8:55am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/6 "2017-12-26T08:55:04Z")
What is the output of the [cat indices API](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html)? ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 26, 2017, 9:01am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/7 "2017-12-26T09:01:08Z")
@Christian_Dahlqvist, here it is: `curl -k -u elastic -XGET 'https://elk03-pco.easydns.vpn:9200/_cat/indices/logstash*?v&s=index'` health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open logstash-postfix-2017.12.26 uL50rgHJQLqVTHTBKSMGyw 5 1 168404 0 48.6mb 24.1mb So, indices were created, it's just kibana not showing me the logs? Thanks again. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 26, 2017, 9:04am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/8 "2017-12-26T09:04:26Z")
Is Kibana able to access Elasticsearch? Can you try opening Console (under Dev Tools) and run the 'cat indices' command from there? ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 26, 2017, 9:08am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/9 "2017-12-26T09:08:43Z")
Yes, that's also a success: [[Album] Imgur: The magic of the Internet ![](https://i.imgur.com/WwSa5U5.jpg?fb "Imgur: The magic of the Internet") ](https://imgur.com/a/l1m32) (I'm logged in as 'kibana' user into Kibana dashboard) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 26, 2017, 9:14am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/10 "2017-12-26T09:14:01Z")
The 'kibana' user is an internal role that does not have access to any data in the cluster. You need to create a new user that gets the 'kibana\_user' role (can access the .kibana index) together with one or more roles that give access to the 'logstash-\*' indices. ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [December 26, 2017, 9:25am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/11 "2017-12-26T09:25:04Z")
Solved! Yes, it was the user privileges that was causing the issue. 'kibana' (the reserved user) didn't have any access to logstash-\* indices. Thank you very much 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 23, 2018, 9:25am UTC](https://discuss.elastic.co/t/no-indexes-no-error-logs/113015/12 "2018-01-23T09:25:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.