The index is not created and no log is recorded

Elastic Stack Elasticsearch
1

Hello,

The indices were being created normally. And one day it stopped.

The Elastic search create the index for the topbeat but do not create for the Filebeat.
In Logstash's log everything seems to work properly and there is no log from elasticsearch.

I've updated every ptoducts, but still not working.

Is there a way to configure on Elasticsearch debug log?
I really do not know whatelse to do.

logstash 2.3.0
elasticsearch Version: 2.3.0, Build: 8371be8/2016-03-29T07:54:48Z, JVM: 1.7.0_80
filebeat version 1.2.0 (amd64)

Thanks in advance!

2

Is ES running?
Have you tried running LS with --debug?

3

Yes, the ES is running.
I started the LS with --debug, it receives the documents and seems work fine.

What I could notice is the port of Elasticsearch (9200). After a while lots of TIME_WAIT come.

4

Any idea guys?

I really need help. The whole Filebeat is not working with elasticsearch.
I have everything stopped.

Thanks in advance.

5

It might be better if you create a thread in the Filebeat category with some more info.

6

The problem was that the format log has been changed without my Knowledge.

Before:
[4/7/16 12:39:39:813 CET] 00000249 SystemOut O lookupName: java:comp/env/ejb/StructureInformation

After:
[4/7/16 12:39:39:813 CEST] 00000249 SystemOut O lookupName: java:comp/env/ejb/StructureInformation

So, I changed the filter to recognize this new format as bellow.

Before:
match => ["message", "([%{DATESTAMP:timestamp} (\S{3}))\S %{WORD:thread_id} %{WORD:short_name}\s*%{WORD:event_type}\s*%{GREEDYDATA:m
essage_desc}"]

After:
match => ["message", "([%{DATESTAMP:timestamp} (\S)*)] %{WORD:thread_id} %{WORD:Short_name}\s*%{WORD:event_ty
pe}\s*%{GREEDYDATA:message_desc}"]