[ElasticSearch Output Plugin] Dynamic User for authentication


is it possible to set the user in the ElasticSearch output plugin dynamically?

Im trying to retrieve the User Information out of the HTTP Headers which are passed. For the Index its working properly but the User is not getting set.

Here is my config:

input {
      http {
            port => 8080
output {
  if ("" in [headers][username]) {
      elasticsearch {
                hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
                index => "%{[headers][index]}"
                user => "%{[headers][username]}"
                password => "%{[headers][password]}"
                manage_template => false


Following Error is shown within the logs:
[2019-06-14T08:56:03,944][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://%2525%257B%255Bheaders%255D%255Busername%255D%257D:xxxxxx@ES-HOST>", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL '<ES-HOST>"}

If I set the User manually it works fine.


No, you cannot do this. The elasticsearch output establishes a connection and authenticates during startup, it does not wait for an event to come along, so you cannot reference fields from an event in the configuration.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.