[ElasticSearch Output Plugin] Dynamic User for authentication

[salkonuhannovic (Salko Nuhanovic)]

Hi,

is it possible to set the user in the ElasticSearch output plugin dynamically?

Im trying to retrieve the User Information out of the HTTP Headers which are passed. For the Index its working properly but the User is not getting set.

Here is my config:

input {
      http {
            port => 8080
           }
}
output {
  if ("" in [headers][username]) {
      elasticsearch {
                hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
                index => "%{[headers][index]}"
                user => "%{[headers][username]}"
                password => "%{[headers][password]}"
                manage_template => false
       }
  }

}

Following Error is shown within the logs:
[2019-06-14T08:56:03,944][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://%2525%257B%255Bheaders%255D%255Busername%255D%257D:xxxxxx@ES-HOST>", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL '<ES-HOST>"}

If I set the User manually it works fine.

Thanks,
Salko

[Badger]

@salkonuhannovic

index => "%{[headers][index]}" user => "%{[headers][username]}" password => "%{[headers][password]}"

No, you cannot do this. The elasticsearch output establishes a connection and authenticates during startup, it does not wait for an event to come along, so you cannot reference fields from an event in the configuration.