# Unable to fetch mapping **URL:** \ **Category:** Kibana\ **Created:** [November 3, 2015, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656 "2015-11-03T17:03:36Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\ **Post date:** [November 3, 2015, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/1 "2015-11-03T17:03:36Z")
Hi, I have set a Kibana server and I am trying to get it up and running I must admit, I am very new to kibana and am in learning mode. I have the following events sent via syslog using port 514 (I am using the root user for now) I have written the following input ``` input { udp { port => 514 type => syslog } } filter { if [type] == "syslog" { grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:evt_type}).*?endpoint=(%{HOSTNAME:ep_host_name}).*?(%{IPV4:ep_ip}).*?type=(%{GREEDYDATA:Protection_module})\,.*?caller=(%{GREEDYDATA:caller})\,.*?callee=\'(%{GREEDYDATA:callee})\,.*?MD5=(%{GREEDYDATA:md5})\,.*?description=(%{GREEDYDATA:description})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:evt_type}).*?endpoint=(%{HOSTNAME:ep_host_name}).*?(%{IPV4:ep_ip}).*?type=(%{GREEDYDATA:Protection_module})\,.*?caller=(%{GREEDYDATA:caller})\,.*?callee=\'(%{IPV4:Destination_ip}).*(%{NUMBER:Destination_port}).*MD5=(%{GREEDYDATA:md5})\,.*description=(%{GREEDYDATA:description})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:evt_type}).*?(?\b\w+\b\s*\b\w+\b).*?(%{HOSTNAME:ep_host_name}).*?(%{IPV4:ep_ip})\)\s*.*?(%{GREEDYDATA:action})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:evt_type}).*?Agent.*?(%{HOSTNAME:ep_host_name}).*?(%{IPV4:ep_ip})\)\s*.*?(%{GREEDYDATA:action})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:evt_type}).*?ip=(%{IPV4:ep_ip})\s*.*?(%{GREEDYDATA:action})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:user_for_installation})\@(%{HOSTNAME:ep_host_name}).*?(%{GREEDYDATA:action})' } } grok { match => { message => '(%{NUMBER:pre_number}).*?(%{TIMESTAMP_ISO8601:time}).*?(%{IPV4:server_ip}).*?(%{HOSTNAME:server_name}).*?(%{NOTSPACE:par_srv_version}).*?(%{WORD:user_for_installation})\@(%{HOSTNAME:ep_host_name}).*?(%{GREEDYDATA:action})' } } } } ``` I have restarted the logstash service. When I try to discover and create an index I get the "Unable to fetch mapping" What am I missing? Thanks Yoram ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 3, 2015, 6:19pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/2 "2015-11-03T18:19:42Z")
Have you configured an elasticsearch output or do you only have inputs and filters? ---
**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\ **Post date:** [November 4, 2015, 7:57am UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/3 "2015-11-04T07:57:27Z")
The only output I have configured is the one that was in the [installation guide](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-4-on-ubuntu-14-04) ``` output { elasticsearch { host => localhost } stdout {codec => rubydebug } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 4, 2015, 1:13pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/4 "2015-11-04T13:13:58Z")
Okay. Disable the elasticsearch output for now. Do you get anything to stdout if you send anything to port 514? ---
**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\ **Post date:** [November 4, 2015, 1:15pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/5 "2015-11-04T13:15:23Z")
By disabling the elasticsearch output you mean put everything in comment or delete the file? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 4, 2015, 1:17pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/6 "2015-11-04T13:17:23Z")
Make sure `elasticsearch { host => localhost }` isn't read by Logstash. Doesn't matter if you comment out the line or delete it. ---
**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\ **Post date:** [November 4, 2015, 1:32pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/7 "2015-11-04T13:32:48Z")
Hi, I have commented the line. restarted the logstash & elasticsearch services. I am still not getting any events into Kibana. Run the following in my server http://:9200/\_cat/indices?v and got the following: ``` health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open .kibana 1 1 1 0 2.5kb 2.5kb ``` In Kibana the status is as seen in the attached pic ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5453c9c0c06414926527c8b9c64aefd24d87f8ab.PNG) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 4, 2015, 1:47pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/8 "2015-11-04T13:47:55Z")
If you comment out the elasticsearch output there will obviously not be any events sent to Elasticsearch. That's the point. We remove one source of errors to ease debugging. Now. Do you get anything to stdout if you send anything to port 514? If yes, do your filters work as expected? ---
**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\ **Post date:** [November 4, 2015, 5:19pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/9 "2015-11-04T17:19:59Z")
So.... now I have the events coming in. for some reason I couldn't receive events in IP4 and also I had to change the port to a higher port to resolve it. THanks for pointing me in the right direction ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:09pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping/33656/10 "2017-07-06T14:09:59Z")