Simple logstash.conf not producing index

[lynnptilby (Lynn)]

Here is my logstash.conf:

input {
file {
"path" /home/ubuntu/ELK/2018-12-05-17-33.log
}
}

output {
elasticsearch {
"hosts" => "127.0.0.1"
"index" => "hwm_a"
}
}

There are no errors in /var/log/ syslog ./elasticsearch/gc.log.0.current ./logstash/logstash-plain.log , and hwm_a does not show up in Create Index Pattern.

I am restarting logstash with systemctl restart logstash each time logstash.conf is changed.

Thank You for your help!

[shrikantgulia (Shrikant)]

Hey @lynnptilby,

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html
also in place of 127.0.0.1 put 127.0.0.1:9200

would suggest you to change the name of the index.

Regards
Shrikant

[lynnptilby (Lynn)]

Hi,

I made the changes suggested above:

"hosts" => "127.0.0.1:9200"
"index" => "hwmb"

No difference... hwmb is not showing in Kibana in Create index pattern.

My gut feel is that this is not a logstash.conf syntax problem; but, is perhaps an elasticsearch problem?

THOUGHTS anyone?

Thanks again everyone for your help!

[shrikantgulia (Shrikant)]

Hello,

when you ping localhost:9200 does it give info about the cluster name ?

[Christian_Dahlqvist]

The file input plugin is designed to by default tail the file, so will not process anything unless data is appended to it. You can change this behaviour by setting sincedb_path and start_position parameters as outlined in this blog post.