# LogStash isn't sending data to OpenSearch **URL:** \ **Category:** OpenSearch\ **Tags:** troubleshoot\ **Created:** [January 20, 2026, 1:49pm UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755 "2026-01-20T13:49:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![djager](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@djager](https://forum.opensearch.org/u/djager)\ **Post date:** [January 20, 2026, 1:49pm UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/1 "2026-01-20T13:49:46Z")
Hello everyone! I’m just getting started with OpenSearch and I’m having trouble with one of the steps. I’ve been trying to figure it out for days. I’d be really grateful if you could guide me, thank you. I installed OpenSearch Ver. 3, OpenSearch Dashboard Ver. 3, and used Logstash 9.2.4, from Elastic as recommended and Winlogbeat-9.2.3 for Windows. I deployed it using Docker Compose. P.S: I removed the links to the repository to bypass the restrictions on links in the topic > **Docker-Compose.yml** > > * * * > > services: > opensearch-node1: > image: opensearchproject/opensearch:3 > container\_name: opensearch-node1 > environment: > > - cluster.name=opensearch-cluster > - node.name=opensearch-node1 > - discovery.seed\_hosts=opensearch-node1,opensearch-node2 > - cluster.initial\_cluster\_manager\_nodes=opensearch-node1,opensearch-node2 > - bootstrap.memory\_lock=true # along with the memlock settings below, disables swapping > - OPENSEARCH\_JAVA\_OPTS=-Xms4096m -Xmx4096m # minimum and maximum Java heap size, recommend setting both to 50% of system RAM > - OPENSEARCH\_INITIAL\_ADMIN\_PASSWORD=${OPENSEARCH\_INITIAL\_ADMIN\_PASSWORD} # Sets the demo admin user password when using demo configuration, required for OpenSearch 2.12 and higher > ulimits: > memlock: > soft: -1 > hard: -1 > nofile: > soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems > hard: 65536 > volumes: > - opensearch-data1:/usr/share/opensearch/data > ports: > - 9200:9200 > - 9600:9600 # required for Performance Analyzer > networks: > - opensearch-net > opensearch-node2: > image: opensearchproject/opensearch:3 > container\_name: opensearch-node2 > environment: > - cluster.name=opensearch-cluster > - node.name=opensearch-node2 > - discovery.seed\_hosts=opensearch-node1,opensearch-node2 > - cluster.initial\_cluster\_manager\_nodes=opensearch-node1,opensearch-node2 > - bootstrap.memory\_lock=true > - OPENSEARCH\_JAVA\_OPTS=-Xms4096m -Xmx4096m > - OPENSEARCH\_INITIAL\_ADMIN\_PASSWORD=${OPENSEARCH\_INITIAL\_ADMIN\_PASSWORD} > ulimits: > memlock: > soft: -1 > hard: -1 > nofile: > soft: 65536 > hard: 65536 > volumes: > - opensearch-data2:/usr/share/opensearch/data > networks: > - opensearch-net > opensearch-dashboards: > image: opensearchproject/opensearch-dashboards:3 > container\_name: opensearch-dashboards > ports: > - 5601:5601 > expose: > - ‘5601’ > environment: > OPENSEARCH\_HOSTS: ‘[“opensearch-node1:9200”,“opensearch-node2:9200”]’ > networks: > - opensearch-net > logstash: > image: [docker.elastic.co/logstash/logstash:9.2.4](http://docker.elastic.co/logstash/logstash:9.2.4) > container\_name: logstash > ports: > - “5044:5044” > volumes: > - /home/user/OpenSearch/logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf > - /home/user/OpenSearch/root-ca.pem:/usr/share/logstash/config/root-ca.pem > command: \> > /bin/sh -c ’ > echo “Checking and installing plugins…”; > if ! /usr/share/logstash/bin/logstash-plugin list | grep -q logstash-output-opensearch; then > /usr/share/logstash/bin/logstash-plugin install logstash-output-opensearch; > fi; > if ! /usr/share/logstash/bin/logstash-plugin list | grep -q logstash-input-opensearch; then > /usr/share/logstash/bin/logstash-plugin install logstash-input-opensearch; > fi; > echo “Starting Logstash…”; > /usr/share/logstash/bin/logstash -f /usr/share/logstash/pipeline/logstash.conf > ’ > networks: > - opensearch-net > > volumes: > opensearch-data1: > opensearch-data2: > > networks: > opensearch-net: For Logstash, I used the logstash-output-opensearch and logstash-input-opensearchh plugins. > **logstash.conf** > > input { > beats { > port =\> 5044 > } > } > > filter { > > } > > output { > if [type] == “beats\_input” { > > ```auto > opensearch { > hosts => ["opensearch-node1:9200", "opensearch-node2:9200"] > user => "admin" > password => "password" > index => "winlogs-%{+YYYY.MM.dd}" > > ssl => true > ssl_certificate_verification => false > cacert => "/usr/share/logstash/config/root-ca.pem" > manage_template => false > } > > ``` > > } > #stdout { codec =\> rubydebug } > } [Error link](https://github.com/opensearch-project/logstash-output-opensearch/issues/278) The problem is that all containers start, and logs from WinLogBeat are being sent to Logstash. I can see this if I enable debug mode, but no data appears in OpenSearch. I can’t create a Create Index Pattern. ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/b0f7e5cbae648a932b6a97033a5709638fd02f82.png) ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [January 20, 2026, 4:12pm UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/2 "2026-01-20T16:12:35Z")
@djager What is your Logstash configuration? When you’re using Logstash 7.13+ you’ll need OpenSearch output plugin > **[Compatibility matrices - Tools](https://docs.opensearch.org/latest/tools/#compatibility-matrices)** > > This section provides documentation for OpenSearch-supported tools, including: | OpenSearch tools ---
**Author:** ![djager](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@djager](https://forum.opensearch.org/u/djager)\ **Post date:** [January 21, 2026, 10:32am UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/4 "2026-01-21T10:32:58Z")
@pablo I’m using a Logstash image from ELK version 9.2.4. Opensearch itself is 3.0, and WinLogBeats is 9.2.3. Judging by the matrix, they are incompatible, am I correct? Can you recommend a replacement for Logstash, or should I downgrade? ---
**Author:** ![DdangJin](https://avatars.discourse-cdn.com/v4/letter/d/9de053/32.png) [@DdangJin](https://forum.opensearch.org/u/DdangJin)\ **Post date:** [January 22, 2026, 8:31am UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/5 "2026-01-22T08:31:21Z")
@djager If there is no reason to use the version 9, I recommend using the version logstash 8.x with opensearch-output-plugin. [doc](https://docs.opensearch.org/latest/tools/logstash/index/) If you don’t need a logstash ecs compatible setting, consider disabling it too! [doc](https://github.com/opensearch-project/logstash-output-opensearch/blob/main/docs/ecs_compatibility.md) ---
**Author:** ![djager](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@djager](https://forum.opensearch.org/u/djager)\ **Post date:** [January 23, 2026, 8:22am UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/6 "2026-01-23T08:22:59Z")
@Ddangjin The documentation you provided uses Logstash version 8.8.2, but the version of the logstasg-output-opensearch plugin is unclear. I’ve tried installing both the 2.0.2 or 2.0.4 LOO plugin in both automatic and manual modes, using Logstash version 8.8.2 or 8.12.2, but I get an aws-sdk ~\> 3 incompatibility error. If I install it automatically, the installation hangs for an hour during the plugin installation and then fails. I don’t understand the compatibility matrix on the website; it seems outdated. Does sending logs from WinLogBeats to the Data PrepPrep recommended by OpenSearch work? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [January 23, 2026, 7:58pm UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/7 "2026-01-23T19:58:06Z")
@djager I’ve got this working with Logstash oss 9.2.0 and 9.2.4 This was my Dockerfile ```auto FROM docker.elastic.co/logstash/logstash-oss:${LOGSTASH_VER} RUN logstash-plugin install logstash-integration-aws RUN logstash-plugin install logstash-output-opensearch ``` Regarding alternatives, you could consider using Data Prepper instead. > **[Getting started with OpenSearch Data Prepper](https://docs.opensearch.org/latest/data-prepper/getting-started/)** > > Getting started with OpenSearch Data Prepper ---
**Author:** ![DdangJin](https://avatars.discourse-cdn.com/v4/letter/d/9de053/32.png) [@DdangJin](https://forum.opensearch.org/u/DdangJin)\ **Post date:** [January 26, 2026, 3:31am UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/8 "2026-01-26T03:31:52Z")
@djager You can do it with the content that pablo wrote, Try logstash with plugins provided by OpenSearch. > **[Other Packages, Tools & Drivers - Artifacts By Version](https://opensearch.org/artifacts/by-version/#0-logstash-oss-with-opensearch-output-plugin)** > > Available release lines: ---
**Author:** ![djager](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@djager](https://forum.opensearch.org/u/djager)\ **Post date:** [January 27, 2026, 12:26pm UTC](https://forum.opensearch.org/t/logstash-isnt-sending-data-to-opensearch/27755/9 "2026-01-27T12:26:26Z")
@pablo Thanks, it worked with Logstash OSS.