# Outputing Logstash logs to Elastic Index fails

**URL:** <https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774>\
**Category:** Elasticsearch\
**Created:** [August 28, 2023, 5:35am UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774 "2023-08-28T05:35:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aashini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aashini/32/98857_2.png) [@aashini](https://discuss.elastic.co/u/aashini)\
**Post date:** [August 28, 2023, 5:35am UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/1 "2023-08-28T05:35:13Z")

</div>

I am using Logstash version 7.11 and and trying to output logs from logstash pipeline to Elastic version 8.\*.  
I am using hosts, index, api\_key, ssl and action params with ssl =\> true and action =\> "create" .

```auto
output {
    elasticsearch {
       hosts => ["***"]
       index => "***"
       api_key => "***"
       ssl => true
       action => "create"
    }
}

```

I don't see any logs in Elastic. and see this error : "only write ops with an op\_type of create are allowed in data streams"  
Can someone help with any pointers what could be wrong/missing.

---

<div class="post-metadata">

**Author:** ![Samuele\_Lolli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuele_lolli/32/107848_2.png) [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)\
**Post date:** [August 28, 2023, 6:34am UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/2 "2023-08-28T06:34:42Z")

</div>

Hi @aashini!  
You are working in with elastic in the cloud or installed locally?  
Can you give all the log you get when you start the pipeline?

---

<div class="post-metadata">

**Author:** ![aashini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aashini/32/98857_2.png) [@aashini](https://discuss.elastic.co/u/aashini)\
**Post date:** [August 30, 2023, 5:28pm UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/3 "2023-08-30T17:28:38Z")

</div>

I work with elastic in the cloud. And I found the fix by using cloud id param instead of hosts param. Thanks for response.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 30, 2023, 5:57pm UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/4 "2023-08-30T17:57:15Z")

</div>

Hi @aashini  
this is kinda of down deep in the weeds ... complicated because you are using such an old version of Logstash.

> [@aashini](#):
>
> I don't see any logs in Elastic. and see this error : "only write ops with an op\_type of create are allowed in data streams"  
> Can someone help with any pointers what could be wrong/missing.

Where is the data originating from? a Beat? something else?

Are you purposely trying to write to a data stream?

If you are The problem is that the incoming data / documents have a field `[@metadata][op_type]` that is probably set to `index` and that is why it is failing...

You can try removing that field or set it to `create`

Or you can manually create and index in 8.x elasticsearch and the output to that.

You could also try updated to an 8.x logstash ....

---

<div class="post-metadata">

**Author:** ![aashini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aashini/32/98857_2.png) [@aashini](https://discuss.elastic.co/u/aashini)\
**Post date:** [September 8, 2023, 5:41am UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/5 "2023-09-08T05:41:55Z")

</div>

@stephenb yes, looks like old logstash version doesn't support writing to data stream (which was preferable). So I am writing logs to an Index now and planning to upgrade to 8.x logstash soon.  
Thanks for your reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2023, 5:42am UTC](https://discuss.elastic.co/t/outputing-logstash-logs-to-elastic-index-fails/341774/6 "2023-10-06T05:42:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.