# Deadletter queue

**URL:** <https://discuss.elastic.co/t/deadletter-queue/236684>\
**Category:** Logstash\
**Created:** [June 11, 2020, 11:00am UTC](https://discuss.elastic.co/t/deadletter-queue/236684 "2020-06-11T11:00:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pankaj\_Jadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_jadhav/32/65896_2.png) [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\
**Post date:** [June 11, 2020, 11:00am UTC](https://discuss.elastic.co/t/deadletter-queue/236684/1 "2020-06-11T11:00:18Z")

</div>

```auto
Hi 

have to add event,metadata in dead letter queue when will get any exception in http filter.

am using pipelines.yml as follows
=================================================================
- pipeline.id: pipeline21
  path.config: "/etc/logstash/conf.d/ds_test1conf"
  queue.type: persisted
- pipeline.id: pipeline21
  path.config: "/etc/logstash/conf.d/ds_test4.conf"
  queue.type: persisted
  dead_letter_queue.enable: true
=================================================================
ds_test4.conf file 
input {
kafka {
    bootstrap_servers => "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092"
    topics => ["DS_Test"]
    decorate_events => true
    group_id => "ds_test"
    codec => json
    max_poll_records => "100"
    consumer_threads => 2
    session_timeout_ms => "30000"
    auto_offset_reset => "earliest"
    client_id => "logstash-ingestion"
 }
}
filter
{
        mutate { add_field => { "[@metadata][document_id]" => "36_20006_7"}}
        http {
                  body_format => "json"
                  follow_redirects => false
                  body => {"Record" => [{"nounModifier"=>"" "itemId"=>"20006" "field"=>"itemDescription" "normalizedText"=>"" "softDelete"=>"pank1" "IndexedOn"=>"" "appId"=>"36" "contactcode"=>"0" "text"=>"ball 20 mm" "id"=>"36_20006_7" "type"=>"AS"}]}
                  url => "https://dsmdmdev-itemmdm.seadevds.p.azurewebsites.net/normalizer/update_es"
                  verb => "POST"
                  headers => {"Content-Type" => "application/json"}
           }
		   if [tags][0] == "_httprequestfailure" {
		    mutate { add_field => { "[@metadata][code]" => "pankaj"}}
		   }
}

output{
elasticsearch {
                                hosts => "http://172.20.188.15:9200"
                                user => "elastic"
                                password => "changeme"
                                index => "flowersfoods_62"
                                document_id => "test"
                                #document_id => "12_100"
                                action => "index"
                }
        stdout { codec => rubydebug { metadata => true} }
}
===================================================================
inside tags am getting "_httprequestfailure " so i want to add this event in "deadletterqueue". but cant able to see anything in deadletterqueue folder in logstash. but same event getting index in elastic. but as per my requirement if any exception is there we needs to add event inside deadletterqueue.
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2020, 2:15pm UTC](https://discuss.elastic.co/t/deadletter-queue/236684/2 "2020-06-11T14:15:19Z")

</div>

> [@Pankaj\_Jadhav](#):
>
> `but as per my requirement if any exception is there we needs to add event inside deadletterqueue.`

That is not how a DLQ works. The elasticsearch output sends an event to the DLQ if it is unable to send it to elasticsearch.

You could use a conditional in the output section to send events that have an \_httprequestfailure tag to a different output, but that output could not be a DLQ.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 2:20pm UTC](https://discuss.elastic.co/t/deadletter-queue/236684/3 "2020-07-09T14:20:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.