# Sysdig integration with ELK

**URL:** <https://discuss.elastic.co/t/sysdig-integration-with-elk/338057>\
**Category:** Elasticsearch\
**Created:** [July 11, 2023, 5:55am UTC](https://discuss.elastic.co/t/sysdig-integration-with-elk/338057 "2023-07-11T05:55:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pennywise01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pennywise01/32/123268_2.png) [@pennywise01](https://discuss.elastic.co/u/pennywise01)\
**Post date:** [July 11, 2023, 5:55am UTC](https://discuss.elastic.co/t/sysdig-integration-with-elk/338057/1 "2023-07-11T05:55:39Z")

</div>

Hi all, i am trying to intergrate sysdig with ELK stack. I am following a tutorial from a blog. I already configured logstash to put the log into elasticsearch but i got an error.

```auto
> Blockquote

[ERROR] 2023-07-11 05:45:26.719 [Ruby-0-Thread-10: :1] elasticsearch - Failed to install template {:message=>"Got response code '400' contacting Elasticsearch at URL 'https://13.228.47.161:9200/_index_template/logstash'", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:84:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:324:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:311:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:398:in `with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:310:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:318:in `block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:408:in `template_put'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:85:in `template_install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:29:in `install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:17:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch.rb:494:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch.rb:318:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch.rb:283:in `block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:149:in `block in after_successful_connection'"]}

> Blockquote

```

Here is my logstash configuration file:

```auto
> Blockquote
input {
   stdin { }
}

filter {
      grok {
        match => {"message" => "^%{NUMBER:num:int} %{NUMBER:time:float} %{INT:cpu:int} %{NOTSPACE:procname} %{NOTSPACE:tid}$"}
  }
}

output {
    elasticsearch {
      hosts => ["https://13.228.47.161:9200"]
      index => "sysdig-logs-%{+YYYY.MM}"
      user => "elastic"
      password => ""
      ssl_certificate_verification => false
  }
}

`> Blockquote`

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 11, 2023, 6:36am UTC](https://discuss.elastic.co/t/sysdig-integration-with-elk/338057/2 "2023-07-11T06:36:57Z")

</div>

Which version of Logstash and Elasticsearch are you using?

---

<div class="post-metadata">

**Author:** ![pennywise01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pennywise01/32/123268_2.png) [@pennywise01](https://discuss.elastic.co/u/pennywise01)\
**Post date:** [July 11, 2023, 6:47am UTC](https://discuss.elastic.co/t/sysdig-integration-with-elk/338057/4 "2023-07-11T06:47:35Z")

</div>

I am using 8.8 for both

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2023, 6:47am UTC](https://discuss.elastic.co/t/sysdig-integration-with-elk/338057/5 "2023-08-08T06:47:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.