# LogStash.conf with multiple outputs: Data displayed on console, but not sent to ElasticSearch server

**URL:** https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856
**Category:** Logstash
**Created:** [April 8, 2019, 1:56pm UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856 "2019-04-08T13:56:16Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)
#### Post date: [April 8, 2019, 1:56pm UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856/1 "2019-04-08T13:56:16Z")

</div>

Here is my `logstash.conf`:

```
input {
	http {
		host => "127.0.0.1"
		port => 31311 
	}
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
  }
  stdout {
    codec => "rubydebug"
  }
}

```

As a test, I ran this command in `PowerShell`:

```
C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -XPUT "http://127.0.0.1:31311/customer?pretty"

```

On my `Logstash` console, as expected, I saw the following output:

```
{
    "@timestamp" => 2019-04-08T13:45:40.267Z,
       "headers" => {
              "http_host" => "127.0.0.1:31311",
        "http_user_agent" => "curl/7.64.1",
           "request_path" => "/customer?pretty",
         "content_length" => "0",
         "request_method" => "PUT",
           "http_version" => "HTTP/1.1",
            "http_accept" => "*/*"
    },
          "host" => "127.0.0.1",
      "@version" => "1",
       "message" => ""
}

```

I then ran the following command:

```
C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -XGET "http://127.0.0.1:9200/_cat/indices?v"

```

I expected to see that the `customer` index had also been created on my ES server; however, all I saw was

`health status index uuid pri rep docs.count docs.deleted store.size pri.store.size`

with an empty set of results.

What am I missing?

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [April 8, 2019, 2:58pm UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856/2 "2019-04-08T14:58:14Z")

</div>

Hi @Miao,

if one output works, all outputs should be healthy, or more percisely, if one output is not healthy, Logstash will shutdown to prevent data loss... So I would expect the Elasticsearch output to be ok.

The index should be named `logstash-%{+YYYY.MM.dd}`.

I have not used the `http` input in Logstash so can't help you with that.

Everything looks fine to me. (not very helpful but still)

---

<div class="post-metadata">

### Author: ![Miao](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Miao](https://discuss.elastic.co/u/Miao)
#### Post date: [April 9, 2019, 7:08am UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856/3 "2019-04-09T07:08:06Z")

</div>

Thank you for your reply! I am confused: Why should the index be named `logstash-%{+YYYY.MM.dd}`, instead of `customer`, given that I ran the command `C:\Users\Me\Downloads\curl-7.64.1-win64-mingw\bin> .\curl.exe -XPUT "http://127.0.0.1:31311/customer?pretty"`?

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [April 9, 2019, 7:17am UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856/4 "2019-04-09T07:17:10Z")

</div>

I do not use `http` input with Logstash so I might very well be wrong... The [documentation](https://www.elastic.co/guide/en/logstash/6.7/plugins-inputs-http.html) states

```
Using this input you can receive single or multiline events over http(s)

```

I would expect the Elasticsearch index to be `logstash-%{+YYYY.MM.dd}` as that is the Logstash _default_ and the `elasticsearch`output config has no `index`name configured.

The call you make to Logstash looks like something you would make to the Elasticsearch API.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2019, 7:30am UTC](https://discuss.elastic.co/t/logstash-conf-with-multiple-outputs-data-displayed-on-console-but-not-sent-to-elasticsearch-server/175856/5 "2019-05-07T07:30:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
