# Logstash output to elasticsearch - open distro for elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961>\
**Category:** Logstash\
**Created:** [October 22, 2020, 8:30am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961 "2020-10-22T08:30:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jafri6](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@jafri6](https://discuss.elastic.co/u/jafri6)\
**Post date:** [October 22, 2020, 8:30am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961/1 "2020-10-22T08:30:58Z")

</div>

I have been working on this project, and my logstash configuration file works fine. Now I am trying to implement the same thing on a system that is running opendistro/elk stack.

I have tried to fix most of the errors, but now I am receiving this and not sure how to proceed further  
...

```
    [INFO] 2020-10-22 16:13:19.916 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://admin:xxxxxx@localhost:9200/]}}
    [WARN] 2020-10-22 16:13:20.672 [[main]-pipeline-manager] elasticsearch - Restored connection to ES instance {:url=>"https://admin:xxxxxx@localhost:9200/"}
    [INFO] 2020-10-22 16:13:20.948 [[main]-pipeline-manager] elasticsearch - ES Output version determined {:es_version=>7}
    [WARN] 2020-10-22 16:13:20.953 [[main]-pipeline-manager] elasticsearch - Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
    [INFO] 2020-10-22 16:13:20.983 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://localhost:9200"]}
    [ERROR] 2020-10-22 16:13:21.250 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
    [INFO] 2020-10-22 16:13:21.629 [LogStash::Runner] runner - Logstash shut down.

```

Here's the output section of my config

```
output {
        elasticsearch {
                hosts => ["https://localhost:9200"]
                index => "kcpvxbeattest-%{+YYYY.MM.dd}"
                user => "admin"
                password => "xxxxxx"
                ssl => true
                ssl_certificate_verification => false
                manage_template => false
                ilm_enabled => false
        }
        stdout {
                codec => rubydebug
        }
}
```

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 22, 2020, 11:01am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961/2 "2020-10-22T11:01:07Z")

</div>

Hi,

Which version are you running exactly? Are you running Elastic Stack with a BASIC(or higher) license or are you running [OpenDistro](https://opendistro.github.io/for-elasticsearch/)? In the latter case you should check out the [OpenDistro Forum](https://discuss.opendistrocommunity.dev/) for support.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 22, 2020, 2:28pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961/3 "2020-10-22T14:28:39Z")

</div>

Try enabling log.level debug and see if you get a more informative error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 2:28pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-open-distro-for-elasticsearch/252961/4 "2020-11-19T14:28:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.