# Logstash Elasticsearch Input

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-input/272336>\
**Category:** Logstash\
**Created:** [May 6, 2021, 7:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336 "2021-05-06T19:49:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [May 6, 2021, 7:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336/1 "2021-05-06T19:49:27Z")

</div>

I'm trying to extract (or) export logs from Elasticsearch via Logstash  
I would like to write the extracted logs to a file

```auto
input {
  elasticsearch {
    hosts => "elasticsearch.domain.com:9200"
    query => '{ "size": 5, "query": { "match": { "host.ip": "10.1.1.1"} } }'
    size => 5
    user => "<username>"
    password => "<password>"
    scroll => "1m"
    ca_file => "/etc/logstash/certs/ca.crt"
    ssl => true
    index => "winlogbeat-7.10*"
   }
}
output {
  file {
    path => "/var/log/logstash/search-output.txt"
    codec => line
   }
}

```

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [May 6, 2021, 7:53pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336/3 "2021-05-06T19:53:45Z")

</div>

Below is the output from the pipeline execution

 ![Screen Shot 2021-05-06 at 1.26.49 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/3/0303b79b31478ee260d06d08c7544382a923deff.png)

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [May 6, 2021, 7:54pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336/4 "2021-05-06T19:54:28Z")

</div>

After the execution, I don't see the log-extracted written into a log file

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 6, 2021, 9:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336/5 "2021-05-06T21:52:21Z")

</div>

Please do not post pictures of text. They are hard to read (and some folks will be unable to read them at all) and impossible to search. Just post the text. If the text is too big post a link to a gist on github or similar text sharing site.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2021, 9:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input/272336/6 "2021-06-03T21:52:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.