# Logstash output to external Elastic Search server **URL:** https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913 **Category:** Logstash **Created:** [February 27, 2016, 6:24am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913 "2016-02-27T06:24:47Z") **Posts on this page:** 12 **Page:** 1
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 27, 2016, 6:24am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/1 "2016-02-27T06:24:47Z")
HI, have been struggling to get the output of one logstash servers output into an elastics search server. When doing a tcpdump on the ES installation I can see the server is connecting, however when looking at the indexes of ES there are none created for the external logstash server. The output of the logstash server loos as follows: `output { elasticsearch { hosts => ["192.168.163.21:9200"] sniffing => true flush_size => 20 idle_flush_time => 15 index => "IDNS-" } stdout { codec => rubydebug } file { path => "/var/log/syslog/ES/IBIND-%{+YYYY-MM-dd}.log" codec => "rubydebug" } }` The firewall is open on the port ranges 9200 to 9300 however the information is not reaching the ES installation on 192.168.163.21. Could anyone maybe assist as the logs of ES are not showing anything? ---
### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm) #### Post date: [February 28, 2016, 3:15am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/2 "2016-02-28T03:15:21Z")
Can you `telnet 192.168.163.21 9200` from the LS server? What do the LS logs show, did you try `--debug`? ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 28, 2016, 7:43am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/3 "2016-02-28T07:43:42Z")
Yes, I can telnet to the port: `[root@localhost ~]# telnet 192.168.163.21 9200 Trying 192.168.163.21... Connected to 192.168.163.21. Escape character is '^]'.` In the --debug option all starts up however is there something specific I should look for in the output? ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 28, 2016, 7:55am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/4 "2016-02-28T07:55:37Z")
Here is the debug output section: `config LogStash::Codecs::Plain/@charset = "UTF-8" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@hosts = ["192.168.163.21:9200"] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@sniffing = true {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@flush_size = 20 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@idle_flush_time = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@index = "IDNS-" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@codec = "UTF-8"> {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@workers = 1 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@manage_template = true {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@template_name = "logstash" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@template_overwrite = false {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@parent = nil {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@upsert = "" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@doc_as_upsert = false {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@max_retries = 3 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@script = "" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@script_type = "inline" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@script_lang = "" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@script_var_name = "event" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@scripted_upsert = false {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@retry_max_interval = 2 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@retry_max_items = 500 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@action = "index" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@path = "/" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@ssl_certificate_verification = true {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Outputs::ElasticSearch/@sniffing_delay = 5 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} Normalizing http path {:path=>"/", :normalized=>"/", :level=>:debug, :file=>"logstash/outputs/elasticsearch/http_client_builder.rb", :line=>"14", :method=>"build"} Elasticsearch HTTP client options {:hosts=>["http://192.168.163.21:9200/"], :ssl=>nil, :transport_options=>{:socket_timeout=>0, :request_timeout=>0, :proxy=>nil}, :transport_class=>Elasticsearch::Transport::Transport::HTTP::Manticore, :level=>:debug, :file=>"logstash/outputs/elasticsearch/http_client.rb", :line=>"127", :method=>"build_client"}` ---
### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck) #### Post date: [February 28, 2016, 11:13am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/5 "2016-02-28T11:13:50Z")
What inputs do you have? ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 28, 2016, 11:34am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/6 "2016-02-28T11:34:30Z")
The input configuration is as follows: `input { file { type => "IDNS" path => ["/var/log/syslog/172.29.58.3-network.log"] start_position => beginning } file { type => "IDNS" path => ["/var/log/syslog/172.29.58.131-network.log"] start_position => beginning } }` The debug information the the input: `config LogStash::Inputs::File/@type = "IDNS" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@path = ["/var/log/syslog/172.29.58.3-network.log"] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@codec = "UTF-8"> {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@add_field = {} {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@stat_interval = 1 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@discover_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@sincedb_write_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@start_position = "end" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@delimiter = "\n" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@ignore_older = 86400 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@close_older = 3600 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Codecs::Plain/@charset = "UTF-8" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@type = "IDNS" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@path = ["/var/log/syslog/172.29.58.131-network.log"] {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@codec = "UTF-8"> {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@add_field = {} {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@stat_interval = 1 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@discover_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@sincedb_write_interval = 15 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@start_position = "end" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@delimiter = "\n" {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@ignore_older = 86400 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} config LogStash::Inputs::File/@close_older = 3600 {:level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"122", :method=>"config_init"} Plugin not defined in namespace, checking for plugin file {:type=>"filter", :name=>"mutate", :path=>"logstash/filters/mutate", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"76", :method=>"lookup"}` ---
### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck) #### Post date: [February 28, 2016, 11:40am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/7 "2016-02-28T11:40:12Z")
Comment out the elasticsearch output. Are you getting any data to your stdout and file outputs? ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 28, 2016, 11:57am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/8 "2016-02-28T11:57:13Z")
Yes, also with commenting out the elasticsearch section in the output, I get information written to the output file. ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [February 29, 2016, 6:21pm UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/9 "2016-02-29T18:21:55Z")
The index is still not available: `[root@syslog ~]# curl '192.168.163.21:9200/_cat/indices?v' health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open logstash-2016.02.28 5 1 1581621 0 1.1gb 1.1gb yellow open logstash-2016.02.27 5 1 1823938 0 1.2gb 1.2gb yellow open logstash-2016.02.26 5 1 1856485 0 1.3gb 1.3gb yellow open logstash-2016.02.25 5 1 2068778 0 1.4gb 1.4gb yellow open logstash-2016.02.19 5 1 1406589 0 1gb 1gb yellow open logstash-2016.02.18 5 1 399705 0 300.4mb 300.4mb yellow open logstash-2016.02.29 5 1 1211654 0 927.8mb 927.8mb yellow open .kibana 1 1 11 1 37.9kb 37.9kb yellow open logstash-2016.02.20 5 1 1326447 0 955.9mb 955.9mb yellow open logstash-2016.02.24 5 1 1866926 0 1.2gb 1.2gb yellow open logstash-2016.02.23 5 1 1737767 0 1.2gb 1.2gb yellow open logstash-2016.02.22 5 1 1506259 0 1gb 1gb yellow open logstash-2016.02.21 5 1 1366443 0 933.5mb 933.5mb [root@syslog ~]#` ---
### Author: ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans) #### Post date: [March 1, 2016, 9:32am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/10 "2016-03-01T09:32:49Z")
Should I try to get assistance on the Elasticsearch section, or does it more point to logstash this challenge? ---
### Author: ![Robert\_Groos](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@Robert\_Groos](https://discuss.elastic.co/u/Robert_Groos) #### Post date: [April 19, 2016, 5:51pm UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/11 "2016-04-19T17:51:28Z")
Try changing your "INDEX" name to lowercase. Found LS has and issue with uppercase INDICES. index =\> "idns-" } logstash.log _"reason"=\>"Invalid index name [INDEX-2016.], must be lowercase"_ ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913/12 "2017-07-06T05:01:33Z")