# Elasticsearch output Plugin cant send data

**URL:** <https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680>\
**Category:** Logstash\
**Created:** [November 2, 2016, 8:14am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680 "2016-11-02T08:14:25Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![BADMAN](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@BADMAN](https://discuss.elastic.co/u/BADMAN)\
**Post date:** [November 2, 2016, 8:14am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/1 "2016-11-02T08:14:25Z")

</div>

Hi

**i upgraded my local ELK Stack to 5.0.0 . Now Logstash removes the elasticsearch hosturl so it doesnt push data to the Server.**

2016-11-02T08:57:56,936][DEBUG][org.apache.http.impl.conn.DefaultHttpClientConnectionOperator] Connecting to /127.0.0.1:9200  
[2016-11-02T08:57:56,941][DEBUG][org.apache.http.impl.conn.DefaultHttpClientConnectionOperator] Connection established 127.0.0.1:34486\<-\>127.0.0.1:9200  
[2016-11-02T08:57:56,941][DEBUG][org.apache.http.impl.conn.DefaultManagedHttpClientConnection] http-outgoing-0: set socket timeout to 60000  
[2016-11-02T08:57:56,941][DEBUG][org.apache.http.impl.execchain.MainClientExec] Executing request GET /\_nodes HTTP/1.1  
[2016-11-02T08:57:56,941][DEBUG][org.apache.http.impl.execchain.MainClientExec] Target auth state: UNCHALLENGED  
[2016-11-02T08:57:56,942][DEBUG][org.apache.http.impl.execchain.MainClientExec] Proxy auth state: UNCHALLENGED  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> GET /\_nodes HTTP/1.1  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> Connection: Keep-Alive  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> Content-Length: 0  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> Host: 127.0.0.1:9200  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> User-Agent: Manticore 0.6.0  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.headers] http-outgoing-0 \>\> Accept-Encoding: gzip,deflate  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "GET /\_nodes HTTP/1.1[\r][\n]"  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "Connection: Keep-Alive[\r][\n]"  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "Content-Length: 0[\r][\n]"  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "Host: 127.0.0.1:9200[\r][\n]"  
[2016-11-02T08:57:56,946][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "User-Agent: Manticore 0.6.0[\r][\n]"  
[2016-11-02T08:57:56,949][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "Accept-Encoding: gzip,deflate[\r][\n]"  
[2016-11-02T08:57:56,949][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "[\r][\n]"  
[2016-11-02T08:57:56,954][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "HTTP/1.1 200 OK[\r][\n]"  
[2016-11-02T08:57:56,955][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "content-type: application/json; charset=UTF-8[\r][\n]"  
[2016-11-02T08:57:56,955][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "content-encoding: gzip[\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "transfer-encoding: chunked[\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "[\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "6d7[\r][\n]"  
[....]  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "a[\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "[0x3][0x0]M[0xea]sY[0xc2][0x13][0x0][0x0][\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "0[\r][\n]"  
[2016-11-02T08:57:56,956][DEBUG][org.apache.http.wire] http-outgoing-0 \<\< "[\r][\n]"  
[2016-11-02T08:57:56,962][DEBUG][org.apache.http.headers] http-outgoing-0 \<\< HTTP/1.1 200 OK  
[2016-11-02T08:57:56,962][DEBUG][org.apache.http.headers] http-outgoing-0 \<\< content-type: application/json; charset=UTF-8  
[2016-11-02T08:57:56,962][DEBUG][org.apache.http.headers] http-outgoing-0 \<\< content-encoding: gzip  
[2016-11-02T08:57:56,962][DEBUG][org.apache.http.headers] http-outgoing-0 \<\< transfer-encoding: chunked

**An initial Connection is successfull after that it logs out:**

[2016-11-02T08:57:56,969][DEBUG][org.apache.http.impl.execchain.MainClientExec] Connection can be kept alive indefinitely  
[2016-11-02T08:57:56,985][DEBUG][org.apache.http.impl.conn.PoolingHttpClientConnectionManager] Connection [id: 0][route: {}-\>[http://127.0.0.1:9200](http://127.0.0.1:9200)] can be kept alive indefinitely  
[2016-11-02T08:57:56,985][DEBUG][org.apache.http.impl.conn.PoolingHttpClientConnectionManager] Connection released: [id: 0][route: {}-\>[http://127.0.0.1:9200](http://127.0.0.1:9200)][total kept alive: 1; route allocated: 1 of 100; total allocated: 1 of 1000]  
[2016-11-02T08:57:57,033][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>["[http://127.0.0.1:9200](http://127.0.0.1:9200)"], :added=\>[]}}

**Can somebody tell me what is going wrong?**

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 2, 2016, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/2 "2016-11-02T08:39:06Z")

</div>

> [@BADMAN](#):
>
> i upgraded my local ELK Stack to 5.0.0 . Now Logstash removes the elasticsearch hosturl so it doesnt push data to the Server.

What do you mean by this?

What does your config look like?

---

<div class="post-metadata">

**Author:** ![BADMAN](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@BADMAN](https://discuss.elastic.co/u/BADMAN)\
**Post date:** [November 2, 2016, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/3 "2016-11-02T09:03:22Z")

</div>

I mean  
i used the debian repository to upgrade logstash elasticsearch and kibana.  
Logstash removes the configured url (you can see it in the log)

[2016-11-02T08:57:57,033][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:**removed=\>["[http://127.0.0.1:9200](http://127.0.0.1:9200)"], :added=\>[]**}}

My Configuration looks like this:

input {  
file {  
path =\> "/data/logs/192.168.3.1/\*local1.log.2016-10-26"  
}  
}  
filter {  
grok {  
break\_on\_match =\> true  
match =\> { "message" =\> ["%{WORD:node} %{WORD:device\_name} XTM\_5\_Series (%{TIMESTAMP\_ISO8601:timestamp}) firewall: msg\_id=%{QS:msg\_id} %{WORD:Action} %{DATA:source\_network} %{DATA:dest\_network} %{NUMBER:size} (?tcp|udp) %{NUMBER} %{NUMBER:ttl} %{IP:source\_addr} %{IP:dest\_addr} %{NUMBER:source\_port} %{NUMBER:dest\_port} offset", "%{WORD:node} %{WORD:device\_name} XTM\_5\_Series (%{TIMESTAMP\_ISO8601:timestamp}) http-proxy[%{NUMBER}]: msg\_id=%{QS:msg\_id} %{WORD:Action} %{DATA:source\_network} %{DATA:dest\_network} (?tcp|udp) %{IP:source\_addr} %{IP:dest\_addr} %{NUMBER:source\_port} %{NUMBER:dest\_port} msg=%{QS:http\_msg} proxy\_act=%{QS:proxy\_act} op=%{QS:http\_operation} dstname=%{QS:host} arg=%{QS:URI} sent\_bytes="%{NUMBER:sent:int}" rcvd\_bytes="%{NUMBER:received:int}" elapsed\_time="%{NUMBER:httptime:float} sec(s)"", "%{WORD:node} %{WORD:device\_name} XTM\_5\_Series (%{TIMESTAMP\_ISO8601:timestamp}) http-proxy[%{NUMBER}]: msg\_id=%{QS:msg\_id} %{WORD:Action} %{DATA:source\_network} %{DATA:dest\_network} (?tcp|udp) %{IP:source\_addr} %{IP:dest\_addr} %{NUMBER:source\_port} %{NUMBER:dest\_port} msg=%{QS:http\_msg} proxy\_act=%{QS:proxy\_act} rule\_name=%{QS:rule\_name} content\_type=%{QS:contenttype}" ] }  
}  
geoip {  
source =\> "source\_addr"  
target =\> "source\_loc"  
}  
geoip {  
source =\> "dest\_addr"  
target =\> "dest\_loc"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["[http://127.0.0.1:9200](http://127.0.0.1:9200)" ]  
sniffing =\> true  
ssl =\> false  
ssl\_certificate\_verification =\> false  
manage\_template =\> false  
index =\> "watchguard-%{+YYY.MM.DD}"  
}  
}

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 2, 2016, 10:34am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/4 "2016-11-02T10:34:31Z")

</div>

When the ES output starts, it adds the the URL you specify to an initial list of URLS **then** it starts sniffing because your config said it should.  
During sniffing it queries ES using your URL `http://127.0.0.1:9200` using a GET to the `_nodes` endpoint, it checks the reply by iterating over each node map looking for its `http_address` key. Any nodes without a value for this key are assumed to "have HTTP disabled" and are skipped.  
It then deletes all initial URLS that were not successfully sniffed.

@BADMAN - Questions you need to answer:

- Do you have an Elasticsearch cluster?
- If so, what type of nodes do you have in the cluster.
- if not, disable sniffing and retry.

---

<div class="post-metadata">

**Author:** ![BADMAN](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@BADMAN](https://discuss.elastic.co/u/BADMAN)\
**Post date:** [November 2, 2016, 1:21pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/5 "2016-11-02T13:21:48Z")

</div>

ok the Test Maschine isnt a cluster, but this config work well with logstash 2.4. So i thought i should work well. So after i changed sniffing to false, logstash seams to work well but it doesnt create any entry/indexes on elasticsearch.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 2, 2016, 1:26pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/6 "2016-11-02T13:26:03Z")

</div>

> [@BADMAN](#):
>
> index =\> "watchguard-%{+YYY.MM.DD}"

Are you looking to have a 3 digit year or is that a typo?

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 2, 2016, 1:28pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/7 "2016-11-02T13:28:37Z")

</div>

What does the metrics api say? Logstash 5 has a small http server that you can query.  
GET `http://localhost:9600/_node/_stats/_pipeline` -\> returns JSON (like ES does)

---

<div class="post-metadata">

**Author:** ![BADMAN](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@BADMAN](https://discuss.elastic.co/u/BADMAN)\
**Post date:** [November 2, 2016, 2:24pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/8 "2016-11-02T14:24:44Z")

</div>

the 3Y is just a typo.

the full path turn into a 404  
[http://localhost:9600/\_pipeline](http://localhost:9600/_pipeline) returns 404 too

[http://localhost:9600/\_node](http://localhost:9600/_node)  
returns

{"host":"logserver","version":"5.0.0","http\_address":"127.0.0.1:9600","pipeline":{"workers":2,"batch\_size":125,"batch\_delay":5,"config\_reload\_automatic":false,"config\_reload\_interval":3},"os":{"name":"Linux","arch":"amd64","version":"4.4.0-45-generic","available\_processors":2},"jvm":{"pid":30470,"version":"1.8.0\_91","vm\_name":"OpenJDK 64-Bit Server VM","vm\_version":"1.8.0\_91","vm\_vendor":"Oracle Corporation","start\_time\_in\_millis":1478092562095,"mem":{"heap\_init\_in\_bytes":1073741824,"heap\_max\_in\_bytes":1056309248,"non\_heap\_init\_in\_bytes":2555904,"non\_heap\_max\_in\_bytes":0},"gc\_collectors":["ParNew","ConcurrentMarkSweep"]}}

[http://localhost:9600/\_stats](http://localhost:9600/_stats)  
returns

{"host":"logserver","version":"5.0.0","http\_address":"127.0.0.1:9600","events":{"in":null,"filtered":0,"out":0,"duration\_in\_millis":null},"jvm":{"timestamp":1478092562095,"uptime\_in\_millis":2768764,"memory":{"heap\_used\_in\_bytes":330004528,"heap\_used\_percent":15,"heap\_committed\_in\_bytes":2112618496,"heap\_max\_in\_bytes":2112618496,"non\_heap\_used\_in\_bytes":182081088,"non\_heap\_committed\_in\_bytes":193454080,"pools":{"survivor":{"peak\_used\_in\_bytes":17432576,"used\_in\_bytes":19162824,"peak\_max\_in\_bytes":17432576,"max\_in\_bytes":34865152,"committed\_in\_bytes":34865152},"old":{"peak\_used\_in\_bytes":106121544,"used\_in\_bytes":165740928,"peak\_max\_in\_bytes":899284992,"max\_in\_bytes":1798569984,"committed\_in\_bytes":1798569984},"young":{"peak\_used\_in\_bytes":139591680,"used\_in\_bytes":145100776,"peak\_max\_in\_bytes":139591680,"max\_in\_bytes":279183360,"committed\_in\_bytes":279183360}}}}}

---

<div class="post-metadata">

**Author:** ![BADMAN](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@BADMAN](https://discuss.elastic.co/u/BADMAN)\
**Post date:** [November 2, 2016, 2:37pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/9 "2016-11-02T14:37:04Z")

</div>

found the problem. Logstash require an active logfile. So is it possible to "import"/use old files?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 6, 2016, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/10 "2016-11-06T10:14:32Z")

</div>

> found the problem. Logstash require an active logfile. So is it possible to "import"/use old files?

Of course. Depending on the version of Logstash you may need to set the file input's `ignore_older` option to 0 (zero) och you will have to set `start_position => beginning`. Additionally, make sure the file's position in sincedb doesn't point to the end of the file. Check the file input's documentation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680/11 "2017-07-06T04:30:52Z")

</div>