<div dir="auto">elasticsearch-http is provided by <a href="https://github.com/syslog-ng/syslog-ng/blob/master/scl/elasticsearch/elastic-http.conf">https://github.com/syslog-ng/syslog-ng/blob/master/scl/elasticsearch/elastic-http.conf</a><div dir="auto"><br></div><div dir="auto">Make sure that file is installed. Also the name of the block is using a dash, whereas you were using an underscore. I think it should be all the same as we generally convert lot of things from underscore to dashes but I would check this explicitly.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 1, 2020, 20:49 Russell Fulton <<a href="mailto:r.fulton@auckland.ac.nz">r.fulton@auckland.ac.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<div style="word-wrap:break-word;line-break:after-white-space">
<br>
<br>
<blockquote type="cite">On 31/03/2020, at 7:05 PM, Antal Nemes (anemes) <<a href="mailto:Antal.Nemes@oneidentity.com" target="_blank" rel="noreferrer">Antal.Nemes@oneidentity.com</a>> wrote:<br>
<br>
Just another idea that may give a clue.<br>
<br>
If you start syslog-ng with foreground with debug and trace leve (syslog-ng -Fevdt)l, syslog-ng</blockquote>
<br>
<div>a couple more data points:</div>
<div><br>
</div>
<div><font face="Menlo"> /usr/local/syslog-ng-3.26.1/sbin/syslog-ng -Fedv -s -f ~/short.conf</font></div>
<div><font face="Menlo"> gives no errors and includes</font></div>
<div><font face="Menlo"><br>
</font></div>
<div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">[2020-04-01T15:06:30.869576] Reading shared object for a candidate module; path='/usr/local/syslog-ng-3.26.1/lib/syslog-ng', fname='libhttp.so', module='http'</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">[2020-04-01T15:06:30.871503] Registering candidate plugin; module='http', context='destination', name='http'</span></div>
</div>
<div><span style="font-variant-ligatures:no-common-ligatures"><br>
</span></div>
<div><span style="font-variant-ligatures:no-common-ligatures">endis with:</span></div>
<div><font face="Menlo"><br>
</font></div>
<div><font face="Menlo">[2020-04-01T15:06:30.892770] Starting to read include file; filename='/usr/local/syslog-ng-3.26.1/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2'<br>
[2020-04-01T15:06:30.893592] Module loaded and initialized successfully; module='confgen'<br>
[2020-04-01T15:06:30.894031] Finishing include; filename='/usr/local/syslog-ng-3.26.1/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2'<br>
[2020-04-01T15:06:30.894188] Finishing include; filename='/usr/local/syslog-ng-3.26.1/etc/scl.conf', depth='1'<br>
[2020-04-01T15:06:30.894717] Module loaded and initialized successfully; module='afsocket'<br>
Error parsing destination statement, destination plugin elasticsearch_http not found in /home/rful011/short.conf:11:3-11:21:<br>
6           network( transport("tcp") flags(no-multi-line) port(1514) keep-alive(yes));<br>
7       };<br>
8       <br>
9       <br>
10      destination d_elastic {<br>
11---->   elasticsearch_http(<br>
11---->   ^^^^^^^^^^^^^^^^^^</font></div>
<div><font face="Menlo"><br>
</font></div>
<div><font face="Menlo">and </font></div>
<div><font face="Menlo"><br>
</font></div>
<div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures;color:#2fb41d"><b>rful011@secmgrprd02</b></span><span style="font-variant-ligatures:no-common-ligatures">:</span><span style="font-variant-ligatures:no-common-ligatures;color:#400bd9"><b>~</b></span><span style="font-variant-ligatures:no-common-ligatures">$
 /usr/local/syslog-ng/sbin/syslog-ng -V -s -f ~/short.conf </span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">syslog-ng 3 (3.26.1)</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Config version: 3.22</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Installer-Version: 3.26.1</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Revision: </span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Compile-Date: Mar 31 2020 08:54:40</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Module-Directory: /usr/local/syslog-ng-3.26.1/lib/syslog-ng</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Module-Path: /usr/local/syslog-ng-3.26.1/lib/syslog-ng</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Include-Path: /usr/local/syslog-ng-3.26.1/share/syslog-ng/include</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,timestamp,dbparser,disk-buffer,examples,geoip2-plugin,tfgetent,graphite,hook-commands,http,json-plugin,kvformat,linux-kmsg-format,map-value-pairs,pseudofile,mod-python,snmptrapd-parser,stardate,syslogformat,system-source,tags-parser,xml</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-Debug: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-GProf: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-Memtrace: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-IPv6: on</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-Spoof-Source: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-TCP-Wrapper: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-Linux-Caps: off</span></div>
<div style="margin:0px;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo">
<span style="font-variant-ligatures:no-common-ligatures">Enable-Systemd: off</span></div>
<div><span style="font-variant-ligatures:no-common-ligatures"><br>
</span></div>
<div><br>
</div>
<br>
</div>
</div>

______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>