# Parsing word and pdf file in elasticsearch using logstash

**URL:** <https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212>\
**Category:** Logstash\
**Created:** [March 20, 2017, 8:15am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212 "2017-03-20T08:15:00Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 20, 2017, 8:15am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/1 "2017-03-20T08:15:00Z")

</div>

I m trying to read pdf file using logstash  
i use following config file

input {  
file {  
path =\> "D:\ELKstack\elastic\page\_ELK.pdf"  
start\_position =\> "beginning"  
}  
}

filter {  
if [type] == ".pdf"{  
multiline {  
pattern =\> "^\n"  
what =\> "next"  
negate=\>false  
}  
}  
}  
output {  
elasticsearch{ hosts =\> ["localhost:9000"] index =\> "logstash-pdf" }  
stdout {codec =\> "rubydebug" }  
}

output is-

ԿD\xA6r\xBD\_\xFF,Gh\xFE}ؙ\xB8g+[\u0006ۿ\xF2\xC5gp^\xE8\xDA\xE7Ym\u0083\xA7\u0013\xF8`'X\xB5\x9E.\xBD\xC5\xFB\xFCR\x97\xBA\x8Fۘ\xB1\x80QH%wE1\u001F\xB5\x9B\x9B\xA2Et\x8B\u001Fd\u0005\x9AC\xA4\xDDKdq@\x96\xC4\xF1\u001AY\xA7L05\xBA\xF0Ӗץ\x99\xEAy\x8E\u0011\xA0\xDD\xDEٽAEӀ\x8A\u0011\"_\x9C\xC4\u001D\xC9avA%\xA3\xB4#\xD7\xE9؋\x838\x96`\xC8'\xB8bL\xED\xB2l;p\xF6\x86\f\t\xB9\u0001O\u0011NGf\xE8tYW\xD6\xF9\xD6t\xADRӐl\xE5e\xD5xL\xA9\xC6y\xE1\u05F9\u0015\xE6\_\xE1j/х,\u0001\x8D\u007F\xB2Fw\>\u000Fa\xC6\u0019|\xF6\xAE\xC9|\xE3\xCC\u0012Q\u00152\xAD~"

it is not readable.what should i do?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 20, 2017, 8:18am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/2 "2017-03-20T08:18:08Z")

</div>

Logstash cannot parse these sorts of files.

See [https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-attachment.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-attachment.html)

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 20, 2017, 9:35am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/3 "2017-03-20T09:35:57Z")

</div>

thanks @warkolm

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 20, 2017, 9:36am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/4 "2017-03-20T09:36:39Z")

</div>

can i do it using kibana?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 20, 2017, 8:59pm UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/5 "2017-03-20T20:59:49Z")

</div>

Nope.

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 21, 2017, 4:22am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/6 "2017-03-21T04:22:01Z")

</div>

ok... thanks

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 21, 2017, 10:08am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/7 "2017-03-21T10:08:09Z")

</div>

i m trying to load pdf in elasticsearch using ingest-attachment  
i tried this-

PUT \_ingest/pipeline/attachment  
{  
"description" : "Extract attachment information",  
"processors" : [  
{  
"attachment" : {  
"field" : "data"  
}  
}  
]  
}

PUT my\_index/my\_type/my\_id?pipeline=attachment  
{  
"data": "JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu=\n"  
}

output-

{  
"error": {  
"root\_cause": [  
{  
"type": "exception",  
"reason": "java.lang.IllegalArgumentException: ElasticsearchParseException[Error parsing document in field [data]]; nested: IllegalArgumentException[Input byte array has wrong 4-byte ending unit];",  
"header": {  
"processor\_type": "attachment"  
}  
}  
]  
can you please tell me what is wrong in this?

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 21, 2017, 10:19am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/8 "2017-03-21T10:19:10Z")

</div>

how can i use apache tika with elasticsearch???

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 22, 2017, 7:09am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/9 "2017-03-22T07:09:38Z")

</div>

Hii @warkolm  
I m trying to load pdf in elasticsearch using ingest-attachment plugin

PUT my\_index/my\_type/my\_id?pipeline=attachment  
{  
"data": "JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu="  
}

output-  
{  
"error": {  
"root\_cause": [  
{  
"type": "illegal\_state\_exception",  
"reason": "There are no ingest nodes in this cluster, unable to forward request to an ingest node."  
}  
],  
"type": "illegal\_state\_exception",  
"reason": "There are no ingest nodes in this cluster, unable to forward request to an ingest node."  
},  
"status": 500  
}

can you please tell me the correction?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 22, 2017, 7:20am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/10 "2017-03-22T07:20:32Z")

</div>

> [@Nikparab](#):
>
> There are no ingest nodes in this cluster, unable to forward request to an ingest node

You need to make sure you have a node that can run the ingest pipelines.

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 22, 2017, 7:22am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/11 "2017-03-22T07:22:20Z")

</div>

@warkolm  
I checked in my elasticsearch.yml file. There is no ingest node.  
Can I add it manually?

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 23, 2017, 7:39am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/12 "2017-03-23T07:39:57Z")

</div>

can u please tell me,  
where do i set ingest node in elasticsearch.yml???

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 23, 2017, 8:29am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/13 "2017-03-23T08:29:14Z")

</div>

Have you read the documentation?  
We are happy to help, but unfortunately we don't have the time to walk you through every step.

---

<div class="post-metadata">

**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Post date:** [March 23, 2017, 9:12am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/14 "2017-03-23T09:12:09Z")

</div>

yes i read the documentation ,but i didn't get where to set that ingest.node in elasticsearch.yml.  
I installed the ingest attachment plugin.  
Thanks @warkolm I will try to resolve it.If any query there then i will get back to you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 9:12am UTC](https://discuss.elastic.co/t/parsing-word-and-pdf-file-in-elasticsearch-using-logstash/79212/15 "2017-04-20T09:12:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
