# Elastic filter plugin https error (ssl?) **URL:** \ **Category:** Logstash\ **Created:** [December 5, 2019, 12:43pm UTC](https://discuss.elastic.co/t/elastic-filter-plugin-https-error-ssl/210711 "2019-12-05T12:43:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![\_Louw](https://avatars.discourse-cdn.com/v4/letter/_/ee7513/32.png) [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Post date:** [December 5, 2019, 12:43pm UTC](https://discuss.elastic.co/t/elastic-filter-plugin-https-error-ssl/210711/1 "2019-12-05T12:43:24Z")
Hi all, I am having trouble getting logstash to only do something, when a change in an index is detected. I have an index _inputs_, where the docs needs to be split out in separate files - but only if the doc is not already a file. So I have made an extra index called _inputs\_list_, where every doc contains the name of a file made. Now I want to - in logstash - loop through all of the docs in _inputs_, and make a file only, if the value of the name-field of the doc _also_ appears in the index _inputs\_list_. For this I am using the elastic filter plugin, but I can't seem to get it to work properly. My logstash code is as follows: ``` input { elasticsearch { hosts => ["https://USER:PASS@HOSTNAME:PORT/"] index => "inputs" query => '{"query": { "match_all": {} } }' scroll => "5m" add_field => {"new_id" => "name"} } } filter { elasticsearch { hosts => ["https://HOSTNAME:PORT/"] ssl => true user => "logstash_internal" password => "xxxxxxx" index => "inputs_liste" query => "name:%{[new_id]}" fields => { "name" => "[name]" } } } ``` I have used various tutorials and questions/answers here from the community, and it seemed to help, that I split up username and password and set ssl up in the filter. But it now gives me the following error: ``` Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=>["C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:79:in `call'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:274:in `call_once'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:158:in `code'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:84:in `block in perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:262:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/client.rb:131:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-api-5.0.5/lib/elasticsearch/api/actions/ping.rb:20:in `ping'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.6.0/lib/logstash/filters/elasticsearch.rb:192:in `test_connection!'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.6.0/lib/logstash/filters/elasticsearch.rb:74:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:in `register'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:191:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:190:in `register_plugins'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:446:in `maybe_setup_out_plugins'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:203:in `start_workers'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:145:in `run'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:104:in `block in start'"], :thread=>"#"} ``` If I remove the "https://" from the hotsname in the filter section, this error appear: ``` Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=>["C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:202:in `__raise_transport_error'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:319:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/client.rb:131:in `perform_request'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/elasticsearch-api-5.0.5/lib/elasticsearch/api/actions/ping.rb:20:in `ping'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.6.0/lib/logstash/filters/elasticsearch.rb:192:in `test_connection!'", "C:/Elastic/logstash-7.0.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.6.0/lib/logstash/filters/elasticsearch.rb:74:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:in `register'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:191:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:190:in `register_plugins'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:446:in `maybe_setup_out_plugins'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:203:in `start_workers'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:145:in `run'", "C:/Elastic/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:104:in `block in start'"], :thread=>"#"} ``` What do I do from here? Is my syntax off? ---
**Author:** ![\_Louw](https://avatars.discourse-cdn.com/v4/letter/_/ee7513/32.png) [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Post date:** [December 6, 2019, 1:51pm UTC](https://discuss.elastic.co/t/elastic-filter-plugin-https-error-ssl/210711/2 "2019-12-06T13:51:12Z")
I stumbled upon this [thread](https://stackoverflow.com/questions/47587777/elasticsearch-filter-not-working-in-logstash) that mentioned the use of enable\_sort =\> false and it works. So.. That was weird, but it works now. Hope this helps others ^^. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2020, 1:51pm UTC](https://discuss.elastic.co/t/elastic-filter-plugin-https-error-ssl/210711/3 "2020-01-03T13:51:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.