Hi, community. I tried to write some data to OpenDistro Elasticsearch using logstash. This is my Logstash output config: output { if "_dateparsefailure" not in [tags] and [@metadata][kafka][topic]=="squid_before_logstash" { elasticsearch { hosts => "hzzp://<es_node>:9200" …

Elastic and Logstash version must be same

Hey @ThreatInter - this is a known thing. Take a look at the announcement about Logstash 7.13

@searchymcsearchface to me it looks like that elastic have but a license check in version 7.13 of the OSS *beats / logstash effectively breaking interoperability with open search. Looking at how opensearch came about I could see this as a move from elastic to have their OSS versions of *beats / lo…

Hey @ssi0202 . That’s known and people have been working on it for quite some time. Expect a release of a output plugin for Logstash that works with OpenSearch shortly (possibly today!). In the mean time, you can take a look at the source and build it yourself on github GitHub - opensearch-project/lo…

hi @searchymcsearchface thanks for the quick reply. i will try it out when the plugin is done sounds like its just around the cornor. so it would still be OSS *beats → OSS logstash (with the plugin) ->opensearch correct ? im not sure i agree with the beats → opensearch is not that widely used, ba…

Yup. Disclaimer: I’ve not personally used OSS beats → logstash → opensearch, but this is what I’ve been told should work. It’s on my list to write up (look for that soon). If this is a greenfield project, I’d look at something like Fluentbit instead of Beats. My personal POV is that Fluentbit has a…

Is there any news related to the problem from the beginning? The logstash oss version was released a few days ago and we tested it within our testing lab, based on all opensearch components. We also get the following error message, within logstash: logstash | [2021-08-16T11:37:26,97…

@thsul According to the documentation , 7.13.x

Thank you. Logstash is working now, the wrong plugin was used. Details can be found in the “issue” on github.

Hi @searchymcsearchface I tried to downgrade the Logstash version to 7.13.4 OSS build and still no luck connecting to Opendistro Elasticsearch (1.11.0). Here’s my logstash config: input { beats { port => 5000 codec => "json_lines" } } output { elasticsearch { …

Problem with Logstash and Opendistro Elasticsearch

General Feedback

searchymcsearchface August 19, 2021, 1:02pm 12

Do you have the OpenSearch Output plugin? You’ll need that for any version of either OSS Elasticsearch or OpenSearch.

Topic		Replies	Views
Issues with Logstash-7-13-2 not connecting to Elasticsearch - Unable to get license information Open Source Elasticsearch and Kibana	3	1717	October 13, 2021
Could not connect to a compatible version of Elasticsearch - Opensearch 2.9.0-1 - Logstash OutputPlugin 8.9.0 OpenSearch troubleshoot , configure , install	1	3230	October 11, 2023
Logstash \| Elasticsearch output requires licensed cluster as of 7.13 OpenDistro	14	4188	June 7, 2021
Logstash output to opensearch OpenSearch troubleshoot	2	705	October 25, 2022
Logstash-oss with opensearch plugin compatibility issues OpenSearch Client Libraries clients-general	6	1912	February 9, 2022

Problem with Logstash and Opendistro Elasticsearch

Related topics