title: logstash output not showing up in kibana
body: <p>I just started learning Elastic Search and trying to dump IIS logs to ES via logstash and see how it looks in Kibana.
  Have set up all the 3 agents succuessfully and they run witout errors. But when I run logstash on my stored log files, the logs doesnt show up in Kibana. 
  (Am using ES5.0 which doesnt have the 'head' _plugin)</p>
  
  <p>This is the output I see in logstash command.</p>
  
  <pre><code>    Sending Logstash logs to C:/elasticsearch-5.0.0/logstash-5.0.0-rc1/logs which is now configured via log4j2.properties.
  06:28:26.067 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=&gt;{:removed=&gt;[], :added=&gt;["http://localhost:9200"]}}
  06:28:26.081 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Using mapping template from {:path=&gt;nil}
  06:28:26.501 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Attempting to install template {:manage_template=&gt;{"template"=&gt;"logstash-*", "version"=&gt;50001, "settings"=&gt;{"index.refresh_interval"=&gt;"5s"}, "mappings"=&gt;{"_default_"=&gt;{"_all"=&gt;{"enabled"=&gt;true, "norms"=&gt;false}, "dynamic_templates"=&gt;[{"message_field"=&gt;{"path_match"=&gt;"message", "match_mapping_type"=&gt;"string", "mapping"=&gt;{"type"=&gt;"text", "norms"=&gt;false}}}, {"string_fields"=&gt;{"match"=&gt;"*", "match_mapping_type"=&gt;"string", "mapping"=&gt;{"type"=&gt;"text", "norms"=&gt;false, "fields"=&gt;{"keyword"=&gt;{"type"=&gt;"keyword"}}}}}], "properties"=&gt;{"@timestamp"=&gt;{"type"=&gt;"date", "include_in_all"=&gt;false}, "@version"=&gt;{"type"=&gt;"keyword", "include_in_all"=&gt;false}, "geoip"=&gt;{"dynamic"=&gt;true, "properties"=&gt;{"ip"=&gt;{"type"=&gt;"ip"}, "location"=&gt;{"type"=&gt;"geo_point"}, "latitude"=&gt;{"type"=&gt;"half_float"}, "longitude"=&gt;{"type"=&gt;"half_float"}}}}}}}}
  06:28:26.573 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - New Elasticsearch output {:class=&gt;"LogStash::Outputs::ElasticSearch", :hosts=&gt;["localhost:9200"]}
  06:28:26.717 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=&gt;"main", "pipeline.workers"=&gt;4, "pipeline.batch.size"=&gt;125, "pipeline.batch.delay"=&gt;5, "pipeline.max_inflight"=&gt;500}
  06:28:26.736 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
  06:28:26.857 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=&gt;9600}
  </code></pre>
  
  <p>But kibana doesnt show up any indexes. I am a newbie here and am not sure whats going on internally. Could you please help me understand what is wrong here.</p>
  
  <p><a href="https://i.stack.imgur.com/EEyI9.png" rel="nofollow"><img src="https://i.stack.imgur.com/EEyI9.png" alt="enter image description here"></a></p>
  
  <p>Logstash Config file:</p>
  
  <pre><code>input { 
      file {
          type =&gt; "iis-w3c"
          path =&gt; "C:/Users/ras/Desktop/logs/logs/LogFiles/test/aug1/*.log"
        }
  }
  filter {  
      grok {
          match =&gt; ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:serviceName} %{WORD:serverName} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientIP} %{NOTSPACE:protocolVersion} %{NOTSPACE:userAgent} %{NOTSPACE:cookie} %{NOTSPACE:referer} %{NOTSPACE:requestHost} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:win32response} %{NUMBER:bytesSent} %{NUMBER:bytesReceived} %{NUMBER:timetaken}"]
        }
       mutate {
      ## Convert some fields from strings to integers
      #
      convert =&gt; ["bytesSent", "integer"]
      convert =&gt; ["bytesReceived", "integer"]
      convert =&gt; ["timetaken", "integer"]
  
      ## Create a new field for the reverse DNS lookup below
      #
      add_field =&gt; { "clientHostname" =&gt; "%{clientIP}" }
  
      ## Finally remove the original log_timestamp field since the event will
      #   have the proper date on it
      #
      remove_field =&gt; [ "log_timestamp"]
    }
  }
  output {
    elasticsearch { 
          hosts =&gt; ["localhost:9200"]
          index =&gt; "%{type}-%{+YYYY.MM}"
    }
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>