# Logstash compatible version with opensearch 2.16.0

**URL:** <https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847>\
**Category:** OpenSearch\
**Created:** [October 7, 2024, 12:12pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847 "2024-10-07T12:12:32Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 12:12pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/1 "2024-10-07T12:12:32Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
I am using opensearch 2.16.0 on windows and trying to find compatible version of logstash but nothing is working.

**Describe the issue** :  
Getting error unable to create template

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [October 7, 2024, 12:25pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/2 "2024-10-07T12:25:13Z")

</div>

Hi @FaisalVoy,

This might be helpful if you haven’t seen it yet [Install Opensearch output plugin on Windows? - #3 by vincent2mots](https://forum.opensearch.org/t/install-opensearch-output-plugin-on-windows/14863/3)

this might also be worth checking out: [elk/Logstash/opensearch at main · vincent2mots/elk · GitHub](https://github.com/vincent2mots/elk/tree/main/Logstash/opensearch)

Best,  
mj

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [October 7, 2024, 12:47pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/3 "2024-10-07T12:47:01Z")

</div>

Hello,

I would give a shot trying with the logstash output plugin I provided here on the github previsoulsy quoted by @Mantas

I extracted the plugin from a 8.6.1 Logstash version and I’m pretty sure it will work.

Tell us if it’s not the case 🙂

Best regards,

---

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 12:47pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/4 "2024-10-07T12:47:27Z")

</div>

@Mantas Can you please give me overview, I didn’t get you

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [October 7, 2024, 12:48pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/5 "2024-10-07T12:48:17Z")

</div>

@FaisalVoy , can you share with us the output of your Logstash pipeline trying to ingest data into Opensearch?

---

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 12:54pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/6 "2024-10-07T12:54:14Z")

</div>

@vincent2mots  
output {  
if [type] == “booking” {  
opensearch {  
hosts =\> [“[http://127.0.0.1:9200](http://127.0.0.1:9200)”]  
index =\> “booking\_index\_test”  
user =\> “admin”  
password =\> “”  
ssl =\> false  
ssl\_certificate\_verification =\> false  
}  
}

---

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 12:58pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/7 "2024-10-07T12:58:30Z")

</div>

@vincent2mots I am getting this error when I run logstash pipeline. I am using latest logstash oss and opensearch latest version Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>“Java::JavaLang::IllegalStateException”, :message=\>“Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil\n(secs:1728305821.535,utc~:"2024-10-07 12:57:01.5350000858306885",ltz~:nil)\n(etz:nil,tnz:"AST",tziv:"2.0.6",tzidv:"1.2024.2",rv:"3.1.4",rp:"java",win:true,rorv:nil,astz:nil,eov:"1.2.11",eotnz:"???",eotnfz:"???",eotlzn:"???",\ndebian:nil,centos:nil,osx:nil)\nTry setting `ENV['TZ'] = 'Continent/City'` in your script (see [List of tz database time zones - Wikipedia](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones))”, :backtrace=\>[“org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:120)”, “org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)”, “org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)”, “org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)”, “org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1379)”, “org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:139)”, “org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)”, “org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET\_METHOD(MixedModeIRMethod.java:128)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)”, “org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)”, “org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)”, “org.jruby.RubyClass.newInstance(RubyClass.java:949)”, “org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)”, “org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)”, “org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)”, “org.jruby.ir.instructions.CallBase.interpret(CallBase.java:548)”, “org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)”, “org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)”, “org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:88)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET\_METHOD(MixedModeIRMethod.java:238)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)”, “org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:228)”, “org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:476)”, “org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:293)”, “org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:324)”, “org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)”, “org.jruby.ir.interpreter.Interpreter.INTERPRET\_BLOCK(Interpreter.java:118)”, “org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)”, “org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)”, “org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)”, “org.jruby.runtime.Block.call(Block.java:144)”, “org.jruby.RubyProc.call(RubyProc.java:354)”, “org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)”, “java.base/java.lang.Thread.run(Thread.java:834)”]}  
[2024-10-07T15:57:03,776][DEBUG][logstash.agent] Shutting down all pipelines {:pipelines\_count=\>0}

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [October 7, 2024, 1:10pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/8 "2024-10-07T13:10:33Z")

</div>

I see the following error :

> Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil\n

I wonder if u’re not missing the @timestamp field before. I guess u need to it if you want your indices to be sufixed by YYYY.MM.DD

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [October 7, 2024, 1:11pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/9 "2024-10-07T13:11:33Z")

</div>

> [@FaisalVoy](#):
>
> Cannot determine timezone from nil

Or maybe you can check this topic too : [Cannot determine timezone from nil logstash - #4 by SamehSaeed - Logstash - Discuss the Elastic Stack](https://discuss.elastic.co/t/cannot-determine-timezone-from-nil-logstash/347217/4)

---

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 1:27pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/10 "2024-10-07T13:27:17Z")

</div>

@vincent2mots I’ll check but any idea which specific version of logstash should work with latest opensearch on windows?

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [October 7, 2024, 2:04pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/11 "2024-10-07T14:04:39Z")

</div>

I’m not sure it’s related to the Opensearch output Plugin.

To me, it’s more likely a bug due to Windows. Check this link to see : [Cannot determine timezone from nil logstash - #5 by SamehSaeed - Logstash - Discuss the Elastic Stack](https://discuss.elastic.co/t/cannot-determine-timezone-from-nil-logstash/347217/5)

---

<div class="post-metadata">

**Author:** ![FaisalVoy](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FaisalVoy](https://forum.opensearch.org/u/FaisalVoy)\
**Post date:** [October 7, 2024, 2:21pm UTC](https://forum.opensearch.org/t/logstash-compatible-version-with-opensearch-2-16-0/21847/12 "2024-10-07T14:21:26Z")

</div>

@vincent2mots Thanks for responding, I am able to run logstash with latest opensearch on windows.  
Thank you
