# Logstash can't send the data to elastic search

**URL:** <https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626>\
**Category:** Logstash\
**Created:** [October 19, 2017, 9:37pm UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626 "2017-10-19T21:37:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenny123](https://avatars.discourse-cdn.com/v4/letter/k/7ab992/32.png) [@kenny123](https://discuss.elastic.co/u/kenny123)\
**Post date:** [October 19, 2017, 9:37pm UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626/1 "2017-10-19T21:37:52Z")

</div>

Hi,

Below is my logstash configuration:

input {  
beats {  
port =\> 5044  
}  
}

filter {  
if [type] == "abc\_serverlog" {  
grok {  
match =\> { "message" =\> "(%{TIME:logtime}\s+)?(%{WORD:loglevel}\s+)?([%{DATA:class}]\s" }  
remove\_field =\> "residual\_raw1"  
}  
ruby {  
code =\> ' event.set("date", Time.now.strftime("%Y-%m-%d")) '  
}  
mutate {  
replace =\> ["logtime", "%{date} %{logtime}"]  
}  
date {  
match =\> ["logtime", "HH:mm:ss,SSS", "YYYY-MM-dd HH:mm:ss,SSS"]  
remove\_field =\> ["date"]  
}  
}  
}

output {  
if [fields][product] == "abc" {  
elasticsearch {  
hosts =\> ["xx.xx.xx.xx:9200"]  
manage\_template =\> false  
index =\> "web-apache"  
}  
}  
stdout { codec =\> rubydebug }  
}

But logstash can't create index on elastic search and logstash was able to connect to elastic search. Moreover, logstash is running as root and elastic search is running as an user ( since elastic search doesn't allow to run as root).  
Can i please know why logstash wasn't able to create index specified in the config .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 20, 2017, 4:47am UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626/2 "2017-10-20T04:47:57Z")

</div>

Show an example of what you get from the `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![kenny123](https://avatars.discourse-cdn.com/v4/letter/k/7ab992/32.png) [@kenny123](https://discuss.elastic.co/u/kenny123)\
**Post date:** [October 20, 2017, 8:56pm UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626/3 "2017-10-20T20:56:02Z")

</div>

Logstash was successfully able to connect to elastic search but it can't create and send data to index in elastic search.

```
[2017-10-20T13:38:15,350][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://192.168.56.22:9200/"}
[2017-10-20T13:38:15,516][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//xx.xx.xx.xx:9200"]}
[2017-10-20T13:38:15,681][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
[2017-10-20T13:38:15,700][INFO][logstash.pipeline] Pipeline main started
[2017-10-20T13:38:15,838][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2017-10-20T13:38:15,929][INFO][org.apache.kafka.clients.consumer.ConsumerConfig] ConsumerConfig values:
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2017, 8:02pm UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626/4 "2017-10-23T20:02:23Z")

</div>

Please post an example as stated earlier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 8:02pm UTC](https://discuss.elastic.co/t/logstash-cant-send-the-data-to-elastic-search/104626/5 "2017-11-20T20:02:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.