# Logstash unable to send events to Elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462>\
**Category:** Logstash\
**Created:** [January 29, 2016, 10:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462 "2016-01-29T10:13:46Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 10:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/1 "2016-01-29T10:13:46Z")

</div>

I have upgraded the logstash version from 1.4.2 and elasticsearch version from 1.5.0. to 2.1.1 Up gradation was successful, but facing issue while sending events from logstash to Elasticsearch.

Logstash is unable to send the events to elasticsearch?

Kindly help in solving this issue.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 29, 2016, 10:30am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/2 "2016-01-29T10:30:54Z")

</div>

What does your configuration look like?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 10:35am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/3 "2016-01-29T10:35:06Z")

</div>

My output configuration  
output {  
elasticsearch {  
hosts =\> ["22.22.22.222:9200"]  
#protocol =\> "http"  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 29, 2016, 10:42am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/4 "2016-01-29T10:42:58Z")

</div>

Do you see anything in the logs/output? Have you tried starting it in verbose or debug mode? Have you verified that Logstash is actually receiving events to be sent to Elasticsearch, e.g. by using the stdout plugin, so that it is not a problem with one of the inputs or filters?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 11:01am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/5 "2016-01-29T11:01:43Z")

</div>

I have started in verbose mode, yes i have verified that logstash is receiving events.

Do we require to change any configuration changes at Elasticsearch node?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 11:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/6 "2016-01-29T11:13:54Z")

</div>

I am using redis as input source, below i am sharing input configuration

input {  
redis {  
host =\> "ip-11-111-111-111.ec2.internal"  
port =\> "7000"  
data\_type =\> "list"  
key =\> "syslog"  
type =\> "redis-input"  
}  
}

Do i have made any configuration changes here?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 29, 2016, 11:40am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/7 "2016-01-29T11:40:10Z")

</div>

Which version of Logstash are you using? Was there anything in the verbose output that indicate a problem? Can you show us a sample event output through the stdout plugin with rubydebug codec?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 1:07pm UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/8 "2016-01-29T13:07:16Z")

</div>

logstash version is 2.1.1 and getiing below warning

"_Redis connection problem {:exception=\>#Redis::CommandError: CROSSSLOT Keys in request don't hash to the same slot\>, :level=\>:warn}_"

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [January 29, 2016, 1:29pm UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/9 "2016-01-29T13:29:47Z")

</div>

I got below error when i tried sample event output through the stdout plugin with rubydebug codec.

"_Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2016.01.29", :\_type=\>"logs", :\_routing=\>nil}, #\<LogStash::Event:0x2efa5a8b @metadata\_accessors=#\<LogStash::Util::Accessors:0x38ad4c74 @store={}, @lut={}\>, @cancelled=false, @data={"message"=\>"This is a sample", "@version"=\>"1", "@timestamp"=\>"2016-01-29T13:25:48.826Z", "host"=\>"ip-20-334-233-111.ec2.internal"}, @metadata={}, @accessors=#\<LogStash::Util::Accessors:0x7021aced @store={"message"=\>"This is a sample", "@version"=\>"1", "@timestamp"=\>"2016-01-29T13:25:48.826Z", "host"=\>"ip-20-334-233-111.ec2.internal"}, @lut={"host"=\>[{"message"=\>"This is a sample", "@version"=\>"1", "@timestamp"=\>"2016-01-29T13:25:48.826Z", "host"=\>"ip-20-334-233-111.ec2.internal"}, "host"], "type"=\>[{"message"=\>"This is a sample", "@version"=\>"1", "@timestamp"=\>"2016-01-29T13:25:48.826Z", "host"=\>"ip-20-334-233-111.ec2.internal"}, "type"]}\>\>], :response=\>{"index"=\>{"\_index"=\>"logstash-2016.01.29", "\_type"=\>"logs", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Failed to parse mapping [default]: Mapping definition for [geoip] has unsupported parameters: [path : full]", "caused\_by"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Mapping definition for [geoip] has unsupported parameters: [path : full]"}}}}, :level=\>:warn}_"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462/10 "2017-07-06T05:13:45Z")

</div>


