# Send playbook output to Logstash/Elasticsearch **URL:** \ **Category:** Ansible Project\ **Created:** [July 6, 2015, 11:50pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696 "2015-07-06T23:50:55Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [July 6, 2015, 11:50pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/1 "2015-07-06T23:50:55Z")
I’m starting to run playbooks automatically via a push server. Basically emulating what you can get with Puppet. As part of that, I’d like to send the output of my cronjob playbooks into my ELK stack. Which is hard to do when the default output is so unreadable. Here’s effectively what I want to get: [http://pastebin.com/eVVcLfKn](http://pastebin.com/eVVcLfKn) Basically, a log entry per task per host. From what I’ve seen googling around, the way to do this is via a callback plugin. So I looked at [https://github.com/ansible/ansible/blob/devel/plugins/callbacks/log\_plays.py](https://github.com/ansible/ansible/blob/devel/plugins/callbacks/log_plays.py) and got lost. My Python skills are very low, and apparently my general dev skills are currently not up to the task. I tried modifying log\_plays to just dump the data variable raw, but I keep running into errors… Any tips? Has anyone already solved this problem? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [July 7, 2015, 12:25am UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/2 "2015-07-07T00:25:58Z")
log\_plays was designed to drop the json to syslog-ng which would then push it to elastic search w/o need for logstash, probably easier to just setup syslog-ng to do the same. ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [July 7, 2015, 12:37am UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/3 "2015-07-07T00:37:29Z")
The default log\_plays doesn’t actually output all the information I need. I have lots of stuff going to syslog and then into ELK already, but in this case, I figured I’d just let logstash-forwarder watch the ansible log file. Then format the output so that logstash doesn’t have to filter it at all. Currently, I figured out how to get valid json out per line. But I’m stuck figuring out how to get the task name, the role name, and the command line command information. Are there global vars I can reference from the plugin? Where could I find a list of them? ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [July 7, 2015, 6:26pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/4 "2015-07-07T18:26:06Z")
With some work I have almost exactly what I want. See: [http://pastebin.com/G819PEZY](http://pastebin.com/G819PEZY) Questions: The status of that restart apache 2 task should be “CHANGED”, since it actually did change during the play run. But it seems like the value for changed tasks is always “OK”. Is there a way to change that? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [July 7, 2015, 8:19pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/5 "2015-07-07T20:19:58Z")
status will be OK in both cases, you need to look at changed : true/false ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [July 7, 2015, 10:32pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/6 "2015-07-07T22:32:21Z")
Ah, that makes sense. Thanks! ---
**Author:** ![dubravko\_sever](https://avatars.discourse-cdn.com/v4/letter/d/ecae2f/32.png) [@dubravko\_sever](https://forum.ansible.com/u/dubravko_sever)\ **Post date:** [December 16, 2016, 10:56pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/7 "2016-12-16T22:56:57Z")
Hi David This post is quite old, but can you share your experience with me, because I’m trying to build something like you have done. I’me trying to build environment that is able to track security policies applied at server level, and than I cold create pretty reports from Elastic/Kibana, and use it for generating inventory items. Thanks in advance. Thanks Dubravko ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://forum.ansible.com/u/Gabriel_Rosca)\ **Post date:** [December 17, 2016, 6:15pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/8 "2016-12-17T18:15:05Z")
What about the callback module 🙂 [https://github.com/ujenmr/ansible-logstash-callback/blob/master/README.md](https://github.com/ujenmr/ansible-logstash-callback/blob/master/README.md) Regards, Gabriel ---
**Author:** ![dubravko\_sever](https://avatars.discourse-cdn.com/v4/letter/d/ecae2f/32.png) [@dubravko\_sever](https://forum.ansible.com/u/dubravko_sever)\ **Post date:** [December 17, 2016, 7:22pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/9 "2016-12-17T19:22:30Z")
Hi, Exactly I’ve been looking for, if it collects json results from ansible (will test it) Thanks Dubravko ---
**Author:** ![dubravko\_sever](https://avatars.discourse-cdn.com/v4/letter/d/ecae2f/32.png) [@dubravko\_sever](https://forum.ansible.com/u/dubravko_sever)\ **Post date:** [January 18, 2017, 11:20am UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/10 "2017-01-18T11:20:20Z")
Hi, Using given callback I’m able to log events from ansible to logstash/elastic search. But can’t search ansible\_result field because it represent field as string, for instance: “{“changed”:“false”, “msg”:“some message”}”. In ELK I’m trying to get format like this one “ansible\_result”:{ Any ideas how to resolve this issue? Dubravko ---
**Author:** ![ujenmr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ujenmr/32/10342_2.png) [@ujenmr](https://forum.ansible.com/u/ujenmr)\ **Post date:** [January 26, 2017, 7:00pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/11 "2017-01-26T19:00:12Z")
Hi, I’m author of the module, I can fix it. I will return with result… Ievgen ---
**Author:** ![ujenmr](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ujenmr/32/10342_2.png) [@ujenmr](https://forum.ansible.com/u/ujenmr)\ **Post date:** [January 27, 2017, 8:06pm UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/12 "2017-01-27T20:06:09Z")
Try to use the new version [https://github.com/ujenmr/ansible-logstash-callback](https://github.com/ujenmr/ansible-logstash-callback) ---
**Author:** ![Aaron\_Hicks](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Aaron\_Hicks](https://forum.ansible.com/u/Aaron_Hicks)\ **Post date:** [July 26, 2019, 3:51am UTC](https://forum.ansible.com/t/send-playbook-output-to-logstash-elasticsearch/18696/13 "2019-07-26T03:51:04Z")
Late to the game, but this is the best ranked answer so far: Is there a callback that logs _directly_ to ElasticSearch without logstash?