# Only title/first row get inserted in in elasticsearch

**URL:** <https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119>\
**Category:** Logstash\
**Created:** [December 16, 2021, 9:30am UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119 "2021-12-16T09:30:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [December 16, 2021, 9:30am UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/1 "2021-12-16T09:30:08Z")

</div>

Hello team,  
I am sending data to Elasticsearch , I have .log files which containes below data. But Only title/first row get inserted in in Elasticsearch

Sample log:

```auto
Server Started	Timestamp	SeverityID	EventID	Severity	Message
20161121T183241.000+0400	20161121T183241.000+0400	4	700	Information	NUMA: QVS configured to get adapt to NUMA environment

```

Logstash:

```auto
filter {
    if [type] == "facebook" {
        grok {
            match => {
                message => [
                    '%{NUMBER}\s*%{NUMBER}\s*%{WORD:level}\s*%{GREEDYDATA}\s*EBIL\\%{WORD:userid}',
                    '%{NUMBER}\s*%{NUMBER}\s*%{WORD:level}\s*%{GREEDYDATA:message1}',
                    '%{GREEDYDATA}\s*user\\%{WORD:userid}',
                    '%{GREEDYDATA:message1}'
                ]
            }
        }
		mutate {
            add_field => { "log" => "%{time} %{message}" }
        }     
        date {
            match => ["time", "yyyyMMdd'T'HHmmss.SSS"]
            target => "@timestamp"
        }
        mutate {
            remove_field => ["message1","message","kafkatime"]
        }                                 
    }
}

```

Kibana data looks like:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39eddcf052086476b2c1c9723bc784b4cb47a356.png)

---

<div class="post-metadata">

**Author:** ![shanamendez](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@shanamendez](https://discuss.elastic.co/u/shanamendez)\
**Post date:** [December 16, 2021, 9:35am UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/2 "2021-12-16T09:35:41Z")

</div>

input {  
beats {  
port =\> 5044  
codec =\> multiline {  
pattern =\> "(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2},(\d){3}"  
negate =\> true  
what =\> "previous"  
}  
}  
}  
[dissertation writing services](https://perfectessaywriting.com/dissertation-writing-services)  
filter {  
if [type] == "catalina" {  
grok {  
match =\> ["message", "(?(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2},(\d){3})"]  
}  
date {  
match =\> ["sourcestamp" , "yyyy-MM-dd HH:mm:ss,SSS"]  
timezone =\> "UTC"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [December 16, 2021, 9:37am UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/3 "2021-12-16T09:37:57Z")

</div>

sending data throgh fluentd agent to logstash

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 16, 2021, 4:36pm UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/4 "2021-12-16T16:36:02Z")

</div>

Your timestamps appear to be from 2016. Have you adjusted the time scale picker in kibana to include that, or are you just looking at recent events?

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [December 16, 2021, 6:10pm UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/5 "2021-12-16T18:10:26Z")

</div>

On recent events as well giving same issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2022, 6:10pm UTC](https://discuss.elastic.co/t/only-title-first-row-get-inserted-in-in-elasticsearch/292119/6 "2022-01-13T18:10:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.