There seems to be a inconsistency between the input and output versions for logstash elasticsearch.
Input elastic search does not understand the parameter "host" even though it is documented on the website. Input elasticsearch does not require to specify the "cluster" parameter to read events even though it is not the default one.
Output elasticsearch requires the "cluster" parameter when writing to elasticsearch.
Any ideas if these are bugs, or is this how it is designed to be? It would also be nice if the documentation went a bit further with cases...
Is there a place that shows samples of other peoples logstash configurations - like:
Read from Elasticsearch
Filter using GROK
Write to Elasticsearch