# Logstash not pushing logs to ElasticSearch **URL:** \ **Category:** Logstash\ **Created:** [July 17, 2019, 8:15am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915 "2019-07-17T08:15:17Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2019, 8:35pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/26 "2019-07-25T20:35:28Z")
PAN-OS\_Syslog or PAN-OS\_SysLog? It does not appear to match the case you are testing for. ---
**Author:** ![Brindha\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brindha_s/32/50344_2.png) [@Brindha\_S](https://discuss.elastic.co/u/Brindha_S)\ **Post date:** [July 26, 2019, 7:52am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/27 "2019-07-26T07:52:17Z")
Sorry, my bad. I changed the cases and tried twice (with lower case and upper case in input and filter). No luck. I even removed the tag from input and filter, doesn't seem to work. The [message] attribute in the conditional, does it work only with syslog input? I need a solution to search for the 4 keywords in my log file (.txt). ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 26, 2019, 12:39pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/28 "2019-07-26T12:39:09Z")
> [@Brindha\_S](#): > > The [message] attribute in the conditional, does it work only with syslog input? No, it will work with any input that generates a message field. ---
**Author:** ![Brindha\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brindha_s/32/50344_2.png) [@Brindha\_S](https://discuss.elastic.co/u/Brindha_S)\ **Post date:** [July 30, 2019, 6:41am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/29 "2019-07-30T06:41:24Z")
Working now. Thank you 🙂 I've noticed that elasticsearch is ingesting files of size 1GB but generating indices of size 4GB. Is there any way to reduce it? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 30, 2019, 12:16pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/30 "2019-07-30T12:16:00Z")
By default there will be a replica of everything, it is possible to disable that but then you risk data loss if a node fails. [index\_options](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-options.html) can be used to control what gets indexed for each document. Indexing less reduces the volume of indexes, but also limits functionality. I have had use cases where 'index\_options: docs' worked for me and saved a lot of space. You might be better off asking a new question in the elasticsearch forum. ---
**Author:** ![Brindha\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brindha_s/32/50344_2.png) [@Brindha\_S](https://discuss.elastic.co/u/Brindha_S)\ **Post date:** [July 31, 2019, 8:06am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/31 "2019-07-31T08:06:25Z")
Logstash has stopped working again, after ingesting data for 2 days. This is the latest logs recorded. ``` [2019-07-30T23:59:10,202][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}) [2019-07-30T23:59:10,202][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}) [2019-07-30T23:59:10,202][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>52} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 31, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/32 "2019-07-31T12:40:41Z")
> [@Brindha\_S](#): > > FORBIDDEN/12/index read-only You ran out of disk space. Reduce disk usage on the partition(s) that elasticsearch is writing to below 95% and then follow [these](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/126067/12) instructions. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 28, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915/33 "2019-08-28T12:40:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-elasticsearch/190915.md?page=1)