# Logstash OpenSearch Output

**URL:** <https://forum.opensearch.org/t/logstash-opensearch-output/7349>\
**Category:** Security\
**Created:** [October 19, 2021, 6:13pm UTC](https://forum.opensearch.org/t/logstash-opensearch-output/7349 "2021-10-19T18:13:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![louzadod](https://avatars.discourse-cdn.com/v4/letter/l/ea5d25/32.png) [@louzadod](https://forum.opensearch.org/u/louzadod)\
**Post date:** [October 19, 2021, 6:13pm UTC](https://forum.opensearch.org/t/logstash-opensearch-output/7349/1 "2021-10-19T18:13:42Z")

</div>

Hi,  
I’m trying to send data to OpenSearch using LogStash OpenSearch Output Plugin.

On OpenSearch audit logs there are many entries like:

```auto
{
  "_index": "security-auditlog-2021.10.19",
  "_type": "_doc",
  "_id": "Rd6WmXwBI4rOM_mKvxUM",
  "_version": 1,
  "_score": null,
  "_source": {
    "audit_trace_task_parent_id": "Ms_aBTLURsy_eGdWNCvyuA:698723",
    "audit_cluster_name": "logs-corporativos",
    "audit_transport_headers": {
      "_opendistro_security_remote_address_header": "...",
      "_opendistro_security_initial_action_class_header": "GetIndexTemplatesRequest",
      "_opendistro_security_origin_header": "REST",
      "_opendistro_security_user_header": "...",
      "_opendistro_security_remotecn": "logs-corporativos"
    },
    "audit_node_name": "logs-corporativos-master-2",
    "audit_trace_task_id": "XXy6-_cET4CIHg8L6A6nGA:4038008",
    "audit_transport_request_type": "GetIndexTemplatesRequest",
    "audit_category": "INDEX_EVENT",
    "audit_request_origin": "REST",
    "audit_node_id": "XXy6-_cET4CIHg8L6A6nGA",
    "audit_request_layer": "TRANSPORT",
    "@timestamp": "2021-10-19T17:26:05.835+00:00",
    "audit_format_version": 4,
    "audit_request_remote_address": "10.42.241.142",
    "audit_request_privilege": "indices:admin/template/get",
    "audit_node_host_address": "10.42.111.116",
    "audit_request_effective_user": "logstash",
    "audit_node_host_name": "10.42.111.116"
  },
  "fields": {
    "@timestamp": [
      "2021-10-19T17:26:05.835Z"
    ]
  },
  "highlight": {
    "audit_request_effective_user": [
      "@opensearch-dashboards-highlighted-field@logstash@/opensearch-dashboards-highlighted-field@"
    ]
  },
  "sort": [
    1634664365835
  ]
}

```

What is the meaning of such event?  
Is everything fine?  
The logs are not being persisted by OpenSearch.

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [October 20, 2021, 1:26pm UTC](https://forum.opensearch.org/t/logstash-opensearch-output/7349/2 "2021-10-20T13:26:23Z")

</div>

Moving this to the security category - this is more about the audit logs than logstash 🙂

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [October 20, 2021, 1:37pm UTC](https://forum.opensearch.org/t/logstash-opensearch-output/7349/3 "2021-10-20T13:37:25Z")

</div>

@louzadod  
This is internal communications where GetIndexTemplatesRequest is being called, to obtain template during indexing stage and therefore looks to be ok.

Hope this helps

---

<div class="post-metadata">

**Author:** ![louzadod](https://avatars.discourse-cdn.com/v4/letter/l/ea5d25/32.png) [@louzadod](https://forum.opensearch.org/u/louzadod)\
**Post date:** [October 21, 2021, 8:12pm UTC](https://forum.opensearch.org/t/logstash-opensearch-output/7349/4 "2021-10-21T20:12:00Z")

</div>

Thanks! Everything working pretty fine with Logstash.