# Failed to publish events: temporary bulk send failure

**URL:** https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/327681
**Category:** Beats
**Tags:** fleet, filebeat, ingest-pipeline
**Created:** [March 14, 2023, 2:49pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/327681 "2023-03-14T14:49:46Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Verdugo\_Gonzalo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/verdugo_gonzalo/32/37680_2.png) [@Verdugo\_Gonzalo](https://discuss.elastic.co/u/Verdugo_Gonzalo)
#### Post date: [March 14, 2023, 2:49pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/327681/1 "2023-03-14T14:49:46Z")

</div>

Hello everyone.  
I am trying to modify some parameters of the logs that come from fleet with the "custom logs" integration.

I have created the following pipeline:  
LOG LINE:  
`2023-02-28 09:04:01,937 ERROR [org.jboss.remoting.transport.http.HTTPClientInvoker] (http-172.17.119.148-8180-14) Error creating SSL Socket Factory for client invoker: Error initializing socket factory SSL context: Can not find truststore url.`  
**custom-logs-pipelines**

```auto
[
  {
    "dissect": {
      "field": "message",
      "pattern": "%{date} %{hour} %{log.level} %{origen} %{url} %{message}"
    }
  }
]

```

TEST PIPELINE OK:

```auto
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_id": "_id",
        "_version": "-3",
        "_source": {
          "date": "2023-02-28",
          "origen": "[org.jboss.remoting.transport.http.HTTPClientInvoker]",
          "message": "Error creating SSL Socket Factory for client invoker: Error initializing socket factory SSL context: Can not find truststore url.",
          "hour": "09:04:01,937",
          "log": {
            "level": "ERROR"
          },
          "url": "(http-172.17.119.148-8180-14)"
        },
        "_ingest": {
          "timestamp": "2023-03-14T14:30:47.06430719Z"
        }
      }
    }
  ]
}

```

**integration configuration:**

 ![A](https://us1.discourse-cdn.com/elastic/original/3X/0/5/0527b95f0e1f2e1b4f2a16636f9f71774c047c2f.png)  
 ![B](https://us1.discourse-cdn.com/elastic/original/3X/d/a/dafe96e118e4cc810d2dfb9cd054a4d856f774e5.png)

I also have created a component template

```auto
custom-logs@mapping
{
  "properties": {
    "date": {
      "eager_global_ordinals": false,
      "norms": false,
      "index": true,
      "store": false,
      "type": "keyword",
      "split_queries_on_whitespace": false,
      "index_options": "docs",
      "doc_values": true
    },
    "hour": {
      "eager_global_ordinals": false,
      "norms": false,
      "index": true,
      "store": false,
      "type": "keyword",
      "index_options": "docs",
      "split_queries_on_whitespace": false,
      "doc_values": true
    },
    "log": {
      "type": "object",
      "properties": {
        "level": {
          "type": "keyword"
        }
      }
    },
    "origen": {
      "type": "keyword"
    },
    "message": {
      "type": "text"
    },
    "url": {
      "type": "keyword"
    }
  }
}

```

and finally my index template

 ![C](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43a983cd12cb3e758d8af9e1c90adde406b97398.png)

This is the message I get after all the configuration

```auto
11:47:15.059
elastic_agent.filebeat
[elastic_agent.filebeat][error] failed to publish events: temporary bulk send failure
11:47:16.883
elastic_agent.filebeat
[elastic_agent.filebeat][error] failed to publish events: temporary bulk send failure
11:47:18.433
elastic_agent.filebeat
[elastic_agent.filebeat][error] failed to publish events: temporary bulk send failure
11:47:19.858
elastic_agent.filebeat
[elastic_agent.filebeat][error] failed to publish events: temporary bulk send failure
11:47:21.299
elastic_agent.filebeat
[elastic_agent.filebeat][error] failed to publish events: temporary bulk send failure

```

I really don't know what I'm failing, any help would be very useful at this time.

---

<div class="post-metadata">

### Author: ![Verdugo\_Gonzalo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/verdugo_gonzalo/32/37680_2.png) [@Verdugo\_Gonzalo](https://discuss.elastic.co/u/Verdugo_Gonzalo)
#### Post date: [March 21, 2023, 7:45pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/327681/2 "2023-03-21T19:45:08Z")

</div>

I solved it on my own

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2023, 9:45pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/327681/3 "2023-04-18T21:45:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.