# Logstash isn't sending data to elastic

**URL:** <https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686>\
**Category:** Logstash\
**Created:** [February 28, 2023, 2:51pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686 "2023-02-28T14:51:34Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uzzi](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@Uzzi](https://discuss.elastic.co/u/Uzzi)\
**Post date:** [February 28, 2023, 2:51pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/1 "2023-02-28T14:51:34Z")

</div>

Hi, I've 1 vmq for Kibana+elasticsearch and 1 vm for Logstash.  
Logstash isn't sending data to elastic, this is log:

```auto
[DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu

```

How can I fix?  
logstash 8.6.2 no docker

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 28, 2023, 2:57pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/2 "2023-02-28T14:57:59Z")

</div>

Hello,

This log is unrelated to your issue. If Logstash isn't sending data to Elasticsearch you will have more logs that reference the elasticsearch output, please share those logs.

Also, what does your logstash configuration looks like?

---

<div class="post-metadata">

**Author:** ![Uzzi](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@Uzzi](https://discuss.elastic.co/u/Uzzi)\
**Post date:** [February 28, 2023, 3:33pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/3 "2023-02-28T15:33:45Z")

</div>

I've found this error:  
"\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"data\_stream [logs-\*\*\*\*\*\*\*\*\*\*\*\*\*\*_] must not contain the following characters ['\','/','_','?','"','\<','\>','|',' ',',']"}}}

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 28, 2023, 3:40pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/4 "2023-02-28T15:40:18Z")

</div>

This is saying the data stream names contains illegal characters. What does your output filter look like?

---

<div class="post-metadata">

**Author:** ![Uzzi](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@Uzzi](https://discuss.elastic.co/u/Uzzi)\
**Post date:** [February 28, 2023, 3:42pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/5 "2023-02-28T15:42:34Z")

</div>

I'm tryng to filter fortinet logs

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 28, 2023, 3:46pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/6 "2023-02-28T15:46:24Z")

</div>

> [@Uzzi](#):
>
> I'm tryng to filter fortinet logs

You need to share your logstash configuration, the error says that you are trying to use unsupported characters in the name of the data\_stream.

It is not possible to now how you are naming the data\_stream unless you share your logstash configuration.

---

<div class="post-metadata">

**Author:** ![Uzzi](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@Uzzi](https://discuss.elastic.co/u/Uzzi)\
**Post date:** [March 1, 2023, 6:38am UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/7 "2023-03-01T06:38:49Z")

</div>

Could you suggest me how to fix first cgroup problem?  
After I'll troubleshooting elk issue

Thansk

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 1, 2023, 12:45pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/8 "2023-03-01T12:45:00Z")

</div>

> [@Uzzi](#):
>
> Could you suggest me how to fix first cgroup problem?

This depends entirely on your infrastructure, you didn't say what is your VM OS, how you are using it.

But as I said, this is unrelated to your issue, if you want to fix it you should open another topic or edit this one.

Also, if you search the forum about this issue there will be a couple of posts about it.

---

<div class="post-metadata">

**Author:** ![Uzzi](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@Uzzi](https://discuss.elastic.co/u/Uzzi)\
**Post date:** [March 1, 2023, 6:34pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/9 "2023-03-01T18:34:18Z")

</div>

I've Debian 11 vm  
I hope to fix first problem because, when I'm changing config to fix second problem, logstash doesn't stop fine, I've to reboot vm, and This issue I can resolve, fixing first problem  
I hope!!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2023, 6:34pm UTC](https://discuss.elastic.co/t/logstash-isnt-sending-data-to-elastic/326686/10 "2023-03-29T18:34:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
