# Logstash setting output to elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508>\
**Category:** Logstash\
**Created:** [June 7, 2017, 6:28am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508 "2017-06-07T06:28:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juneyoung\_Oh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juneyoung_oh/32/18729_2.png) [@Juneyoung\_Oh](https://discuss.elastic.co/u/Juneyoung_Oh)\
**Post date:** [June 7, 2017, 6:28am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508/1 "2017-06-07T06:28:40Z")

</div>

I am using logstash to store and analyze logs of an web application.

But some reason logstash keep failing to send data to elasticsearch.  
The error message says "cannot create pipeline".

```
13 [2017-06-07T05:56:36,815][WARN][logstash.shutdownwatcher] {"inflight_count"=>0, "stalling_thread_info"=>{"other"=>[{"thread_id"=>27, "name"=>"[main]<beats", "current_call"=>"[...]/vendor/bundle/jruby/1.9/gems/logstash-input-beats-3.1.12-java/lib/logstash/inputs/beats.rb:213:in `run'"}, {"thread_id"=>22, "name"=>"[main]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:136:in `synchronize'"}, {"thread_id"=>23, "name"=>"[main]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:118:in `synchronize'"}, {"thread_id"=>24, "name"=>"[main]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:118:in `synchronize'"}, {"thread_id"=>25, "name"=>"[main]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:136:in `synchronize'"}]}}
     14 [2017-06-07T05:56:36,816][ERROR][logstash.shutdownwatcher] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
     15 [2017-06-07T05:56:43,985][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, => at line 13, column 12 (byte 149) after output {\n elasticsearch {\n host => [\"localhost:9200\"]\n stdout "}

```

However, I do not see what makes it fail.  
Follow is my configuration for logstash

```
input {
  file {
    path => "/etc/logstash/logs/log*.json"
  }
}

filter {
}

output {
  elasticsearch {
    host => ["localhost:9200"]
    stdout { codec : rubydebug }
    index => "logstash"
  }
}

```

I thought logstash will read `log*.json` files and send it to elasticsearch, it did not.  
What should I do to fix this pipe?

FYI, I am using sebp/elk docker image to do this. So all elk are in the same container.

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [June 7, 2017, 6:56am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508/2 "2017-06-07T06:56:32Z")

</div>

Hi,  
eleasticsearch output plugin don't have any stdout parameter,  
try

```
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "logstash"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Juneyoung\_Oh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juneyoung_oh/32/18729_2.png) [@Juneyoung\_Oh](https://discuss.elastic.co/u/Juneyoung_Oh)\
**Post date:** [June 7, 2017, 7:11am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508/3 "2017-06-07T07:11:15Z")

</div>

Thanks . I just find that out. and also key is `hosts`, not `host`.

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [June 7, 2017, 7:15am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508/4 "2017-06-07T07:15:59Z")

</div>

yes, host ist wrong too :), i edit it ... since is marked as solution is nice if is error free . Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 7:16am UTC](https://discuss.elastic.co/t/logstash-setting-output-to-elasticsearch/88508/5 "2017-07-05T07:16:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.