Ship log continually

Elastic Stack Logstash
1

Hi,
I am trying to ship logs to a different server using a Logstash forwarder and a redis queue...everything is working fine. Logs are shipping. However, I want to continuously ship logs. Currently what i have is, it ships logs once and then it stops shipping and I get the
"No results found
Unfortunately I could not find any results matching your search. I tried really hard. I looked all over the place and frankly, I just couldn't find anything good. Help me, help you. Here are some ideas:"
page in Kibana.

I have tried running the agent as ./logstash agent -f logshipper.conf &
disown

but it still doesn't work. It will only ship the log once and then show the "No results found" page in Kibana.

2

This sounds like a Logstash problem not a Kibana one.

Perhaps moving it to that category and adding more details will allow people to help.

3

Hi Bishaka,

You might need to ask your question in the logstash discuss channel.

But you can check what indexes your Elasticsearch cluster has loaded in it like and how many documents with http://localhost:9200/_cat/indices (change to your elasticsearch host and port if it's not localhost:9200)

Then in Kibana you would create an index pattern for one or more of those indexes. When you do that it should show you the fields in that index.

Regards,
Lee

4

Hi,

I am assuming it is not shipping logs very frequently is because the log file I am trying to ship was updated yesterday. Logstash would only ship frequently if the logfile is updated frequently. Is this correct? Can someone verify this?

5

Logstash would only ship frequently if the logfile is updated frequently. Is this correct?

What do you mean? If the log file isn't updated with new data Logstash obviously won't ship anything.

6

Oh okay! That's what I thought. Thank you for confirming.