Dead Letter Queue DLQ

[cglencr (Craig Glencross)]

I have searched but cannot find any documentation or discussion on how to test the DLQ in 7.4.

I have set the logstash.yml for DLQ as:
dead_letter_queue.enable: true
path.dead_letter_queue: "C:/Applications/ElasticSearch/DeadLetterQueue"

But how to test this works? All of the help on this site explains

1. that you can only use it with an ElasticSearch output.
2. message are only sent to the DLQ when a 400 or 403 occurs
3. has examples on how to input message that exist in a DLQ

So any advice on how to actually get a message to show up in the DLQ would be appreciated.

[Badger]

You can force a 400 with a mapping exception. The following should get a mapping exception for otherField when it tries to send the second event to elasticsearch.

input { generator { count => 1 lines => [ 'object', 'not' ] } }
filter {
    mutate { add_field => { "someField" => '{ "foo": 1 }' } }
    json { source => "someField" target => "otherField" }
    if [message] == "not" {
        mutate { replace => { "otherField" => "just a string" } }
    }
}