Logstash conf with stdin input not pushing data into elasticsearch

[Mohan_M]

Hello all,

I am new to elastic stack I have configured a elastic stack with xpack. when it tried to run a simple logstash conf with stdin input and elasticsearch output. it is not getting inserted into elasticsearch but stdout is return the value, not sure what is missing. please find below code.

input {
stdin {
id => "my_test_id"
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["x.x.x.x:9200"]
index => "lionlogstash-%{+YYYY.MM.dd}"
}
}

[magnusbaeck (Magnus Bäck)]

it is not getting inserted into elasticsearch

How do you know?

[Mohan_M]

hello Magnus,

I checked it with curl
curl --user elastic:password -XGET 'http://x.x.x.x:9200/_cat/indices?pretty'
it returns inly system indexes

[Mohan_M]

while configuring the elastic stack I skipped the ssl part is it mandatory. but I can log in to kibana and see system indexes from the dev tools

[magnusbaeck (Magnus Bäck)]

Okay, and the elastic user has read access to lionlogstash-* indexes?

Anyway, if Logstash has problems sending to ES it'll scream about in its log.

[Mohan_M]

I ran it with --verbose and found the below error

[2018-03-12T11:41:35,163][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://x.x.x.x:9200/", :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://172.x.x.x:9200/'"}

[magnusbaeck (Magnus Bäck)]

You haven't configured the elasticsearch output to authenticate to Elasticsearch even though Elasticsearch requires a username and password.