Logstash parsing data from and to OpenSearch Wazuh Indexes

[pablo]

Hi @lsoon3 Please check my answer in the other thread.

"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n]

@lsoon3 I understand that you’re querying OpenSearch cluster. Did you use OpenSearch input plugin for Logstash? This is my working test config with OpenSearch input and output plugins. input { opensearch { hosts => ["docker1.pablo.local:9200"] index => "sample-http-responses" query => '{ "size":0, "query": { "match_all": {}},"track_total_hits": true }' user => "admin" password => "Eliatra123" ssl => true schedule => "* * * * *" docinfo => true docinfo_ta…