# Logstash does not output to ES

**URL:** <https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041>\
**Category:** Logstash\
**Created:** [December 16, 2019, 5:06pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041 "2019-12-16T17:06:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Terran](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@Terran](https://discuss.elastic.co/u/Terran)\
**Post date:** [December 16, 2019, 5:06pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041/1 "2019-12-16T17:06:06Z")

</div>

I am new to logstash and have worked to configure a basic pipeline. However, this does not seems to output anything into Elasticsearch.  
I can see it send output to stdout though. I am hoping that someone can look over my settings and perhaps identify where I went wrong.

Contents of Pipelines.yml

> - pipeline.id: main  
> path.config: "/etc/logstash/conf.d/beats.conf"

Contents of beats.conf

> input {  
> beats {  
> port =\> 5044  
> }  
> }
> 
> output {  
> elasticsearch {  
> hosts =\> ["[http://elasticserver01@domain.com:9200](http://elasticserver01@domain.com:9200)", "[http://elasticserver02@domain.com:9200](http://elasticserver02@domain.com:9200)", "[http://elasticserver03@domain.com:9200](http://elasticserver03@domain.com:9200)"]  
> index =\> "%{[@metadata][beat]}-%{[@metadata][version]}"  
> }  
> stdout{}  
> }

Contents of logstash.yml

> node.name: server01  
> path.data: /var/lib/logstash  
> pipeline.id: main  
> pipeline.batch.size: 125  
> pipeline.batch.delay: 50  
> path.config: /etc/logstash/conf.d/beats.conf  
> config.test\_and\_exit: true  
> dead\_letter\_queue.enable: true  
> dead\_letter\_queue.max\_bytes: 1024mb  
> path.dead\_letter\_queue: /var/lib/logstash/dead\_letter\_queue  
> log.level: info  
> path.logs: /var/log/logstash  
> logger.elasticsearchoutput.name = logstash.outputs.elasticsearch  
> logger.elasticsearchoutput.level = info

Logstash-plain.log has not entries since November where I was working on getting Logstash installed and set up.

logstash-slowlog-plain.log is empty

Please let me know if I need to post more info.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 16, 2019, 7:07pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041/2 "2019-12-16T19:07:55Z")

</div>

> [@Terran](#):
>
> config.test\_and\_exit: true

logstash just verifies that the config can be compiled when you set this. It does not run the pipeline.

---

<div class="post-metadata">

**Author:** ![Terran](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@Terran](https://discuss.elastic.co/u/Terran)\
**Post date:** [December 16, 2019, 7:11pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041/3 "2019-12-16T19:11:15Z")

</div>

I am pretty sure the pipeline is running. If I remove the stdout config from the pipeline config it won't write anything. When I comment it back in I can see it in the logs. So this makes me thing there is an issue with Elasticsearch section of the outputs, but I can't think of what I am missing.

---

<div class="post-metadata">

**Author:** ![Terran](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@Terran](https://discuss.elastic.co/u/Terran)\
**Post date:** [December 18, 2019, 4:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041/4 "2019-12-18T16:44:12Z")

</div>

So I changed to the index in the conf file to "testindex" then searched for that in Kibana,

GET \_cat/count/testindex

1576687443 16:44:03 1131

So clearly I am getting documents into the index, when I check the Logs tab in Kibana though I don't really see anything. Anyone know what I am missing here?  
I am using default mapping if that matters in regards to which fields are searchable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2020, 4:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-es/212041/5 "2020-01-15T16:44:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.