# OpenSearch only receives logs once per hour

**URL:** <https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173>\
**Category:** OpenSearch\
**Tags:** troubleshoot\
**Created:** [October 6, 2023, 9:55am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173 "2023-10-06T09:55:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ziggiyzoo](https://avatars.discourse-cdn.com/v4/letter/z/e99b99/32.png) [@Ziggiyzoo](https://forum.opensearch.org/u/Ziggiyzoo)\
**Post date:** [October 6, 2023, 9:55am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173/1 "2023-10-06T09:55:39Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Logstash - 7.17.11  
Logstash OpenSearch Output - 1.2.0  
OpenSearch - Helm Chart Version 2.9.0

**Describe the issue** :  
Currently we have Elasticsearch set up, but we are moving to OpenSearch. I’ve set up OpenSearch output following the guide, but OpenSearch is only receiving logs once per hour, while Elasticsearch receives them almost constantly.

The Logstash logs don’t seem out of the ordinary, so I am not sure if this is an issue with the OpenSearch Output setup, or some OpenSearch config I missed.

**Configuration** :  
Logstash Output:

```auto
output {
  if "event-timed-out" in [tags] {
    elasticsearch {
      id => "fallback-elasticsearch-output"
      hosts => ["localhost:9200"]
      index => "fallback-bisappslogs-%{+YYYY.MM.dd}"
    }
    opensearch {
        index => "fallback-bisappslogs-%{+YYYY.MM.dd}"
        hosts => ["host"]
        user => "${}"
        password => "${}"
        ssl_certificate_verification => true
    }
  } else {
    elasticsearch {
      id => "elasticsearch-output"
      hosts => ["localhost:9200"]
      index => "bisappslogs-%{+YYYY.MM.dd}"
    }
    opensearch {
        index => "bisappslogs-%{+YYYY.MM.dd}"
        hosts => ["host"]
        user => "${}"
        password => "${}"
        ssl_certificate_verification => true
    }
  }
}

```

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 6, 2023, 11:01am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173/2 "2023-10-06T11:01:40Z")

</div>

> [@Ziggiyzoo](#):
>
> ` ssl_certificate_verification => true`

Do you use Enterprise certificates in OpenSearch?

---

<div class="post-metadata">

**Author:** ![Ziggiyzoo](https://avatars.discourse-cdn.com/v4/letter/z/e99b99/32.png) [@Ziggiyzoo](https://forum.opensearch.org/u/Ziggiyzoo)\
**Post date:** [October 6, 2023, 11:45am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173/3 "2023-10-06T11:45:03Z")

</div>

The k8s cluster OpenSearch is deployed too has a certificate for the OpenSearch ingress. Though I would have thought any issues with this would have stopped all logs, and given a connection error?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 9, 2023, 8:39am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173/4 "2023-10-09T08:39:51Z")

</div>

@Ziggiyzoo That’s true. You should get a connection error straight away when starting the Logstash.

Have you tried using only the `opensearch` output without the if statement?

---

<div class="post-metadata">

**Author:** ![Ziggiyzoo](https://avatars.discourse-cdn.com/v4/letter/z/e99b99/32.png) [@Ziggiyzoo](https://forum.opensearch.org/u/Ziggiyzoo)\
**Post date:** [October 11, 2023, 11:04am UTC](https://forum.opensearch.org/t/opensearch-only-receives-logs-once-per-hour/16173/5 "2023-10-11T11:04:35Z")

</div>

@pablo Using only OpenSearch output without the if statement has increased the amount and regularity of logs being received.

I’ll see if I can find out if that if statement is still necessary, and will get back to you if I have any more issues, thanks! 🙂