<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Hello, <br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Please check which version of the documentation you use, most likely you obtained the latest instead of 3.8.1 (your version).<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
The elasticsearch-http was introduced in the <a href="https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.21.1">
https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.21.1</a> see the release notes.<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
--<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Kokan<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<span id="OutlookSignature">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Get <a href="https://aka.ms/ghei36">Outlook for Android</a></div>
</span><br>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Kelly Marchewa <kelly_marchewa@yahoo.com><br>
<b>Sent:</b> Sunday, June 16, 2019 3:19:05 AM<br>
<b>To:</b> syslog-ng@lists.balabit.hu<br>
<b>Subject:</b> [syslog-ng] Difficulty with Elasticsearch Destination</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style: solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align: left;">
<span style="color:#9C6500; font-weight:bold;">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<p>Greetings all:</p>
<p>I recently installed syslog-ng on my Debian 9 system. I have tested syslog-ng with a file destination and everything seemed fine. Now, I am attempting?? to set the destination to my local Elasticsearch instance. However, I am receiving the following error:</p>
<pre><i>Error parsing destination, destination plugin elasticsearch-http not found in /etc/syslog-ng/syslog-ng.conf at line 44, column 1:</i></pre>
<pre><i>elasticsearch-http(</i></pre>
<p><i>^^^^^^^^^^^^^^^^^^</i></p>
<p>My configuration, based on the documentation:</p>
<pre><i>elasticsearch-http(</i><i>
</i><i>?? index("syslog")</i><i>
</i><i>?? type("test")</i><i>
</i><i>?? url(<a class="moz-txt-link-rfc2396E" href="http:/localhost:9200/_bulk">"http:/localhost:9200/_bulk"</a>));</i><i>
</i><i>};</i>
</pre>
<p>Output of syslog-ng --version:</p>
<pre><i>syslog-ng 3.8.1</i><i>
</i><i>Installer-Version: 3.8.1</i><i>
</i><i>Revision: 3.8.1-10</i><i>
</i><i>Module-Directory: /usr/lib/syslog-ng/3.8</i><i>
</i><i>Module-Path: /usr/lib/syslog-ng/3.8</i><i>
</i><i>Available-Modules: disk-buffer,redis,date,afstomp,afprog,afsocket,pseudofile,confgen,csvparser,afsql,kvformat,geoip-plugin,afuser,afsmtp,system-source,mod-python,afamqp,riemann,linux-kmsg-format,dbparser,basicfuncs,syslogformat,graphite,afmongodb,json-plugin,cryptofuncs,affile,sdjournal,cef,add-contextual-data</i><i>
</i><i>Enable-Debug: off</i><i>
</i><i>Enable-GProf: off</i><i>
</i><i>Enable-Memtrace: off</i><i>
</i><i>Enable-IPv6: on</i><i>
</i><i>Enable-Spoof-Source: on</i><i>
</i><i>Enable-TCP-Wrapper: on</i><i>
</i><i>Enable-Linux-Caps: off</i></pre>
<div class="moz-signature">
<p>I saw no indication in the documentation that any special modules/plugins needed to be loaded to use Elasticsearch as the destination. Any pointers as to what the issue is would be appreciated.??</p>
</div>
<div class="moz-signature">Thanks!<br>
</div>
<div class="moz-signature">-- <br>
</div>
<div class="moz-signature">Kelly Marchewa<br>
<a class="moz-txt-link-abbreviated" href="mailto:kelly_marchewa@yahoo.com">kelly_marchewa@yahoo.com</a>
</div>
</div>
</div>
</body>
</html>