# Logstash can not write date into elasticsearch after activating elastic security **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [June 12, 2019, 6:53am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340 "2019-06-12T06:53:44Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Post date:** [June 12, 2019, 6:53am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/1 "2019-06-12T06:53:44Z")
Hey guys, I´ve a problem with logstash. After activating the stack security, logstash can not write into elasticsearch. I´ve followed the instructions in the install guide and created a logstash\_internal user which has the rights to write data. Since I have activated these feature I get the following errors in my journal: ``` Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,482][DEBUG] [logstash.config.source.multilocal] Reading pipeline configurations from YAML {:location=>"/etc/logstash/pipelines.yml"} Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,495][DEBUG][logstash.config.source.local.configpathloader] Skipping the following files while reading config since they don't match the specified glob pattern {:files=>["/etc/logstash/conf.d/performance_pipeline.conf", "/etc/logstash/conf.d/pum_pipeline.conf"]} Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,495][DEBUG][logstash.config.source.local.configpathloader] Reading config file {:config_file=>"/etc/logstash/conf.d/logging_pipeline.conf"} Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,496][DEBUG][logstash.agent] Converging pipelines state {:actions_count=>1} Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,511][DEBUG][logstash.agent] Executing action {:action=>LogStash::PipelineAction::Create/pipeline_id:logging_pipeline} Jun 12 00:02:35 logstash-serv logstash[4904]: [2019-06-12T00:02:35,690][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:logging_pipeline, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 41, column 4 (byte 988) after output { \n\tif [type] == \"log\"{\n\t\tif ![MachineName]{\n\t\t\telasticsearch {\n\t\t\t\tindex => \"log-%{+YYYY.MM.dd}\"\n\t\t\t\tid => \"elasticsearch_logging_receiver\"\n\t\t\t\tuser => logstash_internal\n\t\t\t\tpassword => ******** \n\t\t\t", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]} ``` What can I do to fix this issue? Thanks to everyone who can help! Best regards, PolterFox ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 12, 2019, 7:09am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/2 "2019-06-12T07:09:59Z")
Can you share your logstash configuration? ---
**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Post date:** [June 12, 2019, 7:25am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/3 "2019-06-12T07:25:39Z")
Which configuration do you want? - Pipeline Configuration - Pipeines Configuration /etc/logstash/pipelines.yml - Logstash Configuration /etc/logstash/logstash.yml ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 12, 2019, 7:31am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/4 "2019-06-12T07:31:51Z")
Let's start by what you changed after you enabled security for the stack, as the issue will probably be there. ---
**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Post date:** [June 12, 2019, 10:42am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/5 "2019-06-12T10:42:12Z")
I just added the user and password "nodes" into the output block: ``` elasticsearch { index => "log-%{+YYYY.MM.dd}" id => "elasticsearch_logging_receiver" user => logstash_internal password => ******* } ``` ---
**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Post date:** [June 12, 2019, 12:18pm UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/6 "2019-06-12T12:18:11Z")
> [@PolterFox](#): > > Expected one of #, { Potentially a syntax issue, missing a curly bracket somewhere? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 12, 2019, 1:46pm UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/7 "2019-06-12T13:46:45Z")
It surprises me that it expects one of # { when it looks like it should be expecting }. Can you post the entire output section from logging\_pipeline.conf? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 13, 2019, 1:45am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/8 "2019-06-13T01:45:36Z")
> [@PolterFox](#): > > ```auto > elasticsearch { > index => "log-%{+YYYY.MM.dd}" > id => "elasticsearch_logging_receiver" > user => logstash_internal > password => ******* > } > > ``` You need to string-quote those values: ```auto elasticsearch { index => "log-%{+YYYY.MM.dd}" id => "elasticsearch_logging_receiver" user => "logstash_internal" password => " *******" } ``` ---
**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Post date:** [June 13, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/9 "2019-06-13T13:04:07Z")
Thanks that works, there are no errors in the logs right now, but I do not see any data coming into elasticsearch, so there must be another error. Is it possible that logstash holds the data which can not be sent to elasticsearch and tries to work them off (i have persistent pipelines). ---
**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Post date:** [June 13, 2019, 1:42pm UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/10 "2019-06-13T13:42:53Z")
Try going to management --\> security --\> roles --\> logstash\_writer and then add log-\* to the indices section and click on update role. See if that does it. Also try adding logstash-\* if log-\* doesnt work. ---
**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\ **Post date:** [June 14, 2019, 8:24am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/11 "2019-06-14T08:24:21Z")
Thanks that helps. I´ve added \* and thought that this allows logstash\_writer to all my indices, but this was a misunderstanding of me. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 17, 2019, 1:04am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/12 "2019-06-17T01:04:57Z")
> [@PolterFox](#): > > I´ve added \* and thought that this allows logstash\_writer to all my indices It does. Change the index pattern from `*` to `log-*` would reduce the role's (user's) access and would not add any additional indices. I think something else happened here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 15, 2019, 1:05am UTC](https://discuss.elastic.co/t/logstash-can-not-write-date-into-elasticsearch-after-activating-elastic-security/185340/13 "2019-07-15T01:05:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.