# How to send logstash exec cmd output to elasticsearch
**URL:** https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093
**Category:** Logstash
**Created:** [November 9, 2017, 6:57pm UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093 "2017-11-09T18:57:49Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)
#### Post date: [November 9, 2017, 6:57pm UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/1 "2017-11-09T18:57:49Z")
Hi ,
I 'm using exec output plugin and i want to send output of exec cmd to elasticsearch.
My logstash conf as shown below
```
input {
file {
path => "/log/sample.log"
start_position => "beginning"
}
}
filter{
grok {
match => { "message" => "%{GREEDYDATA:myfilename}}
}
}
output{
exec {
command => "ls %{myfilename}"
#this is just sample cmd but i want to use filename to pass it cmd and get the file details here
}
elasticsearch{
}
}
```
now is there is any to send exec cmd output to elasticsearch??
please share your input here.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 9:48pm UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/2 "2017-11-09T21:48:13Z")
Outputs don't send stuff to other outputs. Look at the exec _input_ plugin instead.
---
### Author:  [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)
#### Post date: [November 10, 2017, 7:44am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/3 "2017-11-10T07:44:57Z")
But i need to pass file\_name to the exec cmd during run time , so is there any filter plugin available which will run shell cmd ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 10, 2017, 7:55am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/4 "2017-11-10T07:55:58Z")
No, I do not think so. It would be a very slow filter that would affect performance and also potentially dangerous from a security standpoint. What is it you are trying to achieve? What is the use-case?
---
### Author:  [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)
#### Post date: [November 10, 2017, 8:03am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/5 "2017-11-10T08:03:29Z")
use case is i'm parsing log file but which only provides file\_name and other details now i want to this file\_name and get the file\_attributes of that file using cmd and then merge this info and create index file\_name + file\_attribute info
Here is the flow
log file --\> logtash (extract file\_name from log) ---\> pass this file\_name to cmd and get file attributes --\> index into elasticsearch with filename + file attributes details
What would be the best way to achieve this?
also note that : i dont have permission to modify log file where i can add file attributes along with file attributes
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 10, 2017, 8:09am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/6 "2017-11-10T08:09:27Z")
I can not think of any filter that will allow you to do that out of the box. It may be possible to do it through a ruby plugin, but may also require a custom plugin.
---
### Author:  [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)
#### Post date: [November 10, 2017, 8:31am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/7 "2017-11-10T08:31:49Z")
sure thanks @Christian_Dahlqvist
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2017, 8:38am UTC](https://discuss.elastic.co/t/how-to-send-logstash-exec-cmd-output-to-elasticsearch/107093/8 "2017-12-08T08:38:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.