"type" : "index_not_found_exception"

[Vigneshprasanna (Vigneshprasanna Radhakrishnan)]

Hi,
In this I'm trying to test ELK using a jboss log file placed in a folder I'm done with both ES and kibana. the logstash part I'm not able to configer i have placed the below routine inside a .conf file of config folder.

i get "type" : "index_not_found_exception" exception.

can you please guide me about the .conf file pipeline settings and how to start logstash (I tried starting the logstash by running the bat file inside the bin dir )

1.downloaded logstash
2.unziped
3.created the below conf file inside the config folder

Please let me know is there any more changes i have to go through

Note : Windows machine ES 6.1

input {
file {
path => "D:/Personal/Test_log_files"
type => "file"
}

filter {
grok {
match => [
"message",
"%{TIME:time} %{LOGLEVEL:level} [(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}"
]
overwrite => ["message"]
}
date {
match => ["time", "MMM dd YYYY HH:mm:ss,SSS"]
remove_field => ["time"]
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }

stdout { codec => json }

}
}

[magnusbaeck (Magnus Bäck)]

Please show the full error message.

[Vigneshprasanna (Vigneshprasanna Radhakrishnan)]

{
"error" : {
"root_cause" : [
{
"type" : "index_not_found_exception",
"reason" : "no such index",
"resource.type" : "index_or_alias",
"resource.id" : "logstash-$DATE",
"index_uuid" : "na",
"index" : "logstash-$DATE"
}
],
"type" : "index_not_found_exception",
"reason" : "no such index",
"resource.type" : "index_or_alias",
"resource.id" : "logstash-$DATE",
"index_uuid" : "na",
"index" : "logstash-$DATE"
},
"status" : 404
}

This is the error when i try to access "http://localhost:9200/logstash-$DATE/_search?pretty&q=geoip.city_name=Buffalo"

[magnusbaeck (Magnus Bäck)]

Oh, you're getting that from a curl request. That was impossible to tell from your question. As configured your file input tails the input file. Look into the start_position option to get it to start from the top and learn about sincedb. See the file input documentation.

[magnusbaeck (Magnus Bäck)]

Can you please guide me is this the correct format of .conf file and correct groke pattems for the following log

Check out the grok constructor web site.

[Vigneshprasanna (Vigneshprasanna Radhakrishnan)]

Logstash started how do i know its pushing the data to elastic search ?? still im not able to c the data in kibana .. please guide me

[Vigneshprasanna (Vigneshprasanna Radhakrishnan)]

Now i get an Error saying "Failed to open process token Access is Denied <5>"

[magnusbaeck (Magnus Bäck)]

Logstash started how do i know its pushing the data to Elasticsearch ??

Temporarily replace your elasticsearch output with a stdout { codec => rubydebug } output and use it to verify that Logstash is reading and processing any events at all.

[Vigneshprasanna (Vigneshprasanna Radhakrishnan)]

@magnusbaeck

start_position

Can you please give me a example so i can understand more clearly

Thanks for you great support Magnusbaeck