# Logstash parsing data from and to OpenSearch Wazuh Indexes

**URL:** <https://forum.opensearch.org/t/logstash-parsing-data-from-and-to-opensearch-wazuh-indexes/24569>\
**Category:** Data Prepper\
**Created:** [May 28, 2025, 2:19pm UTC](https://forum.opensearch.org/t/logstash-parsing-data-from-and-to-opensearch-wazuh-indexes/24569 "2025-05-28T14:19:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lsoon3](https://avatars.discourse-cdn.com/v4/letter/l/eb8c5e/32.png) [@lsoon3](https://forum.opensearch.org/u/lsoon3)\
**Post date:** [May 28, 2025, 2:19pm UTC](https://forum.opensearch.org/t/logstash-parsing-data-from-and-to-opensearch-wazuh-indexes/24569/1 "2025-05-28T14:19:10Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

- Use the latest and latest -1 of logstash 9.0.1
- Use OpenSearch 2.13
- Wazuh 4.x
- Ubuntu

**Describe the issue** :  
I intend to use Logstash to read events and alerts from Wazuh’s OpenSearch index and forward the parsed data to another OpenSearch database.

However, I haven’t been able to get it working and I’m unsure which steps I might have missed. I would appreciate it if you could share any guidance or insights how to write codes to parse data from and to different OpenSearch database. Thank you!

**Configuration** :

# Code #1

input {  
opensearch {  
hosts =\> [“[http://opensearch-host:9200](http://opensearch-host:9200)”]  
user =\> “username”  
password =\> “password”  
index =\> “wazuh-_"  
ssl\_enabled =\> false  
schedule =\> "_/5 \* \* \* \*”  
docinfo =\> true  
docinfo\_target =\> “[@metadata][opensearch]”  
size =\> 1000  
}  
}

filter {

# No filters as this time

}

output {  
stdout {  
codec =\> rubydebug  
}

# Codes #2

input {  
opensearch {  
hosts =\> [“[https://your-opensearch-node:9200](https://your-opensearch-node:9200)”]  
index =\> “wazuh-alerts-_"  
user =\> “your\_username”  
password =\> “your\_password”  
ssl =\> true  
query =\> ’  
{  
“query”: {  
“bool”: {  
“must”: [  
{  
“range”: {  
“@timestamp”: {  
“gte”: “now-1h”,  
“lte”: “now”,  
“format”: “strict\_date\_optional\_time”  
}  
}  
},  
{  
“match”: {  
“rule.level”: {  
“query”: 10,  
“boost”: 1.0  
}  
}  
}  
]  
}  
},  
“sort”: [  
{  
“@timestamp”: {  
“order”: “asc”  
}  
}  
]  
}’  
schedule =\> "_ \* \* \* \*”  
size =\> 1000  
scroll =\> “5m”  
docinfo =\> true  
}  
}

# **Relevant Logs or Screenshots** :

[2025-05-28T01:58:19,838][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>“LogStash::ConfigurationError”, :message=\>“Expected one of [\t\r\n], "#", "input", "filter", "output" at line 6, column 1 (byte 132) after “, :backtrace=\>[”/home/onizuwo/logstash-9.0.1/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative’”, “org/logstash/execution/AbstractPipelineExt.java:294:in `initialize’”, “org/logstash/execution/AbstractPipelineExt.java:227:in `initialize’”, “/home/onizuwo/logstash-9.0.1/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize’”, “org/jruby/RubyClass.java:949:in `new’”, “/home/onizuwo/logstash-9.0.1/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute’”, “/home/onizuwo/logstash-9.0.1/logstash-core/lib/logstash/agent.rb:420:in `block in converge\_state’”]}

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 30, 2025, 10:31am UTC](https://forum.opensearch.org/t/logstash-parsing-data-from-and-to-opensearch-wazuh-indexes/24569/2 "2025-05-30T10:31:50Z")

</div>

Hi @lsoon3 Please check my answer in the other thread.

> [@"LogStash::ConfigurationError", :message=\>"Expected one of \[\\\\t\\\\r\\\\n\]](https://forum.opensearch.org/t/logstash-configurationerror-message-expected-one-of-t-r-n/24556/5):
>
> @lsoon3 I understand that you’re querying OpenSearch cluster. Did you use OpenSearch input plugin for Logstash? This is my working test config with OpenSearch input and output plugins. input { opensearch { hosts =\> ["docker1.pablo.local:9200"] index =\> "sample-http-responses" query =\> '{ "size":0, "query": { "match\_all": {}},"track\_total\_hits": true }' user =\> "admin" password =\> "Eliatra123" ssl =\> true schedule =\> "\* \* \* \* \*" docinfo =\> true docinfo\_ta…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [July 29, 2025, 10:32am UTC](https://forum.opensearch.org/t/logstash-parsing-data-from-and-to-opensearch-wazuh-indexes/24569/3 "2025-07-29T10:32:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.