Error 400

Elastic Stack Logstash
1

Hello I want create a mapping but I have the following error :

[ERROR][logstash.outputs.elasticsearch][main] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://127.0.0.1:9200/_template/logstash'", :class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:332:in perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:319:in block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:414:in with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:318:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:326:in block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:352:in template_put'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in template_install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/template_manager.rb:28:in install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/common.rb:134:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.2.3-java/lib/logstash/outputs/elasticsearch/common.rb:51:in block in setup_after_successful_connection'"]}

File /etc/logstash/conf.d/filebeat-entry.conf

input {
beats {
port => 5044
}
}
filter {
if [source][locality] == "public" {
geoip {
source => "[source][ip]"
target => "[source][geo]"
}
}
if [destination][locality] == "public" {
geoip {
source => "[destination][ip]"
target => "[destination][geo]"
}
}
}
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
template => "/etc/logstash/template/classic.json"
index => "filebeat-%{+YYYY.MM.dd}"
}
}

File /etc/logstash/template/classic.json

{
"template": "filebeat-*",
"version": 60001,
"settings": {
"index.refresh_interval": "5s",
"index.number_of_replicas": "0"
},
"mappings": {
"default": {
"properties": {
"@timestamp": { "type": "date" },
"@version": { "type": "keyword" },
"destination": {
"geo": {
"dynamic": true,
"properties": {
"ip": { "type": "ip" },
"location": { "type": "geo_point" },
"latitude": { "type": "half_float" },
"longitude": { "type": "half_float" }
}
}
}
}
}
}
}

Again, thank you for your answers :slight_smile:

2

It's ok I have found the solution.

I explain it tomorrow :wink:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.