# Nothing is getting indexed

**URL:** <https://discuss.elastic.co/t/nothing-is-getting-indexed/51616>\
**Category:** Logstash\
**Created:** [June 1, 2016, 8:58pm UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616 "2016-06-01T20:58:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deepak\_Patnaik](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@Deepak\_Patnaik](https://discuss.elastic.co/u/Deepak_Patnaik)\
**Post date:** [June 1, 2016, 8:58pm UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/1 "2016-06-01T20:58:49Z")

</div>

Hi,

I am new to ELK. I had some log files indexed. Then I deleted the indexes using XDELETE and \_all.

Now when i run logstash, and try to see if the files get indexed again. it does not show any index.

Please help.

The Conf. file looks like this

input  
{  
file {  
path =\> ['/var/log/logstash/ETLLogs/\*.log']  
sincedb\_path =\> "dev/null"  
codec =\> multiline  
{  
pattern =\> "^%{TIMESTAMP\_ISO8601}"  
what =\> "previous"  
negate =\> "true"  
}  
}  
}  
filter  
{  
grok {  
match =\> {"message"=\> "%{WORD:Exception}%{GREEDYDATA:shortmessage}"}  
tag\_on\_failure =\> []  
}  
date {  
match =\> ["event\_timestamp", "yyyy/MM/dd HH:mm:ss"]  
}  
}

output  
{  
elasticsearch {  
index =\> "%{logstash-}%{+yyyy-mm-dd}"  
}  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 2, 2016, 1:21am UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/2 "2016-06-02T01:21:33Z")

</div>

> [@Deepak\_Patnaik](#):
>
> sincedb\_path =\> "dev/null"

If that isn't a typo it'd be why, you need to delete this file or fix the typo.

---

<div class="post-metadata">

**Author:** ![Deepak\_Patnaik](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@Deepak\_Patnaik](https://discuss.elastic.co/u/Deepak_Patnaik)\
**Post date:** [June 5, 2016, 12:06pm UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/3 "2016-06-05T12:06:40Z")

</div>

Thankyou.

I added the following lines to my config file:

start\_position =\> "beginning"

it worked

---

<div class="post-metadata">

**Author:** ![Deepak\_Patnaik](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@Deepak\_Patnaik](https://discuss.elastic.co/u/Deepak_Patnaik)\
**Post date:** [June 5, 2016, 12:08pm UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/4 "2016-06-05T12:08:32Z")

</div>

Right now I have another issue:

My log file is of the pattern:

### Job STARTED at 2014/02/19 19:03:48 (jobId=20140216\_190624\_s2aZn, jobExecutionId=20140219190348\_rmzXR)

for this my filter looks like this:

filter  
{  
grok {

```
    	match => {"message" => "[\n]### Job STARTED at %{GREEDYDATA} (jobId=%{GREEDYDATA:jobid}[\n]"}
	}

date {
match => ["event_timestamp", "yyyy/MM/dd HH:mm:ss"]
}

```

}

When i run the logstash, i get the below error:  
'end pattern with unmatched parentheses'

Need some help around it real quick,

---

<div class="post-metadata">

**Author:** ![Deepak\_Patnaik](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@Deepak\_Patnaik](https://discuss.elastic.co/u/Deepak_Patnaik)\
**Post date:** [June 5, 2016, 6:31pm UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/5 "2016-06-05T18:31:14Z")

</div>

I have another question.

In my log file i have the following pattern:  
2014-02-19 19:13:12|oAmwic|20140219190348\_rmzXR|20140219190348\_rmzXR|ADR\_TST|Dim\_State\_Trade|Default|6|Java Exception|tMSSqlOutput\_1|java.sql.BatchUpdateException:

2014-02-19 19:13:12|oAmwic|20140219190348\_rmzXR|20140219190348\_rmzXR|916|ADR\_TST|Dim\_State\_Trade|\_\_a8TIEepEeG9yIseFOxTIA|0.1|Default||end|failure|80029  
java.lang.RuntimeException: Child job running failed

I have defined the filter as below:

filter  
{  
grok {  
break\_on\_match =\> false  
match =\> ["message", ["java[.]%{GREEDYDATA}[.]%{GREEDYDATA:error\_desc}Exception[:]"]]  
add\_tag =\> ["%{error\_desc}"]  
}  
}

Problem:

Only the first pattern is captured.

The second error, though of the same pattern is not captured.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/nothing-is-getting-indexed/51616/6 "2017-07-06T04:54:29Z")

</div>

Closed on July 6, 2017, 4:54am UTC