# No Output Until Verbose

**URL:** <https://discuss.elastic.co/t/no-output-until-verbose/85272>\
**Category:** Logstash\
**Created:** [May 10, 2017, 2:52pm UTC](https://discuss.elastic.co/t/no-output-until-verbose/85272 "2017-05-10T14:52:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [May 10, 2017, 2:52pm UTC](https://discuss.elastic.co/t/no-output-until-verbose/85272/1 "2017-05-10T14:52:30Z")

</div>

Hi guys,

This is a very strange one. I am unable to get logstash to output to file by starting logstash as normal:

_start logstash_

The strange thing is, when I start logstash in verbose mode it works:

_/usr/share/logstash/bin/logstash --path.settings=/etc/logstash --verbose_

If I start it in verbose mode it gives me an error but still works:

_ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console._

The log4j2 file is located directly under "/etc/logstash/". Anyway, like I said it works. So starting logstash normally I just get a bunch of the following in the log file:  
_[DEBUG][logstash.pipeline] Pushing flush onto pipeline_  
_[DEBUG][logstash.pipeline] Pushing flush onto pipeline_  
_[DEBUG][logstash.pipeline] Pushing flush onto pipeline_  
_[DEBUG][logstash.inputs.file] globbed\_files: /root/scserv/config/2411/w3clog1.log: glob is: []_

I am using logstash 5.4 and the input file is a non-changing test file I created to simulate the environment I want to set this up on. Here is my conf file:

_input {_  
\_ file {\_  
\_ path =\> "/root/scserv/config/2411/w3clog1\_.log"\_  
\_ start\_position =\> beginning\_  
\_ sincedb\_path =\> "/dev/null"\_  
\_ ignore\_older =\> 0\_  
\_ }\_  
_}_

_filter {_  
\_ grok {\_  
\_ match =\> { \_  
\_ "message" =\> '%{IPV4:ip\_address} %{IPV4:src\_ip} %{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{TIME:time} %{NOTSPACE:stream} %{NUMBER:c\_reply} %{NOTSPACE:user\_agent} %{NUMBER:sc\_bytes} %{NUMBER:x\_duration} %{NUMBER:avgbandwidt}'\_  
\_ }\_  
\_ }\_  
\_ grok {\_  
\_ match =\> { \_  
\_ "path" =\> '%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:sid}/%{GREEDYDATA}.log'\_  
\_ }\_  
\_ }\_  
\_ geoip {\_  
\_ source =\> "src\_ip"\_  
\_ target =\> "geoip"\_  
\_ database =\> "/usr/share/logstash/vendor/geoip/GeoLite2-City.mmdb"\_  
\_ }\_  
\_ mutate {\_  
\_ add\_field =\> {\_  
\_ "date" =\> "%{year}-%{month}-%{day} %{time}"\_  
\_ }\_  
\_ add\_field =\> {\_  
\_ "country" =\> "%{[geoip][country\_name]}"\_  
\_ }\_  
\_ remove\_field =\> ["year", "month", "day", "time", "message", "@timestamp", "@version", "host", "c\_reply", "geoip", "path", "src\_ip", "stream"]\_  
\_ } \_  
_}_

_output {_  
\_ file {\_  
\_ path =\> "/root/test.log"\_  
\_ }\_  
_}_

"/root/test.log" only gets filled with verbose mode on.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2017, 8:09pm UTC](https://discuss.elastic.co/t/no-output-until-verbose/85272/2 "2017-05-10T20:09:06Z")

</div>

> This is a very strange one. I am unable to get logstash to output to file by starting logstash as normal:

> start logstash

> The strange thing is, when I start logstash in verbose mode it works:

> /usr/share/logstash/bin/logstash --path.settings=/etc/logstash --verbose

This has nothing to do with the level of logging. In the first case Logstash will run as the logstash user and in the second case it'll run as whatever user is running in your shell.

> [DEBUG][logstash.inputs.file] _globbedfiles: /root/scserv/config/2411/w3clog1_.log: glob is: \_

The logstash user doesn't have access to /root so the filename pattern expands to an empty list and hence Logstash has nothing to do. Why are you storing log files there anyway?

There's been an identical thread here in the past 24 hours.

---

<div class="post-metadata">

**Author:** ![johnslippers](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@johnslippers](https://discuss.elastic.co/u/johnslippers)\
**Post date:** [May 11, 2017, 8:28am UTC](https://discuss.elastic.co/t/no-output-until-verbose/85272/3 "2017-05-11T08:28:24Z")

</div>

Thanks Magnus. You have hit the nail on the head. After changing the location for both my input and output files to a place where the logstash user had access to, it started working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 8:37am UTC](https://discuss.elastic.co/t/no-output-until-verbose/85272/4 "2017-06-08T08:37:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.