### Author:  [@syfwork](https://discuss.elastic.co/u/syfwork)
#### Post date: [March 28, 2024, 9:38am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/1 "2024-03-28T09:38:19Z")
Hi,
I'm using the HTTP output plugin to delete some documents by query.
Here's my config file:
```auto
input {
jdbc {
jdbc_driver_library => "/root/infr/logstash-8.12.2/connector/mysql-connector-j-8.3.0.jar"
jdbc_driver_class => "com.mysql.cj.jdbc.Driver"
jdbc_connection_string => "jdbc:mysql://l"
jdbc_user => "xx"
jdbc_password => "xx"
jdbc_paging_enabled => true
tracking_column => "unix_ts_in_secs"
use_column_value => true
tracking_column_type => "numeric"
schedule => "*/10 * * * * *"
statement => "SELECT build_id FROM xxx"
}
}
filter {
mutate {
remove_field => ["unix_ts_in_secs"]
}
}
output {
http {
url => "xx:9200/index_name/_delete_by_query"
http_method => "post"
format => "json"
user => "xx"
password => "xx"
headers => {
"Content-Type" => "application/json"
}
message => '{"query": {"match": {"build_id": "%{[build_id]}"}}}'
retry_non_idempotent => false
}
}
```
Got this error log:
```auto
Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>"xxx", :event=>#}
```
400 means a bad request, so is this caused by the wrong config for dynamic field ${[build\_id]} in the "message" part?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 28, 2024, 5:01pm UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/2 "2024-03-28T17:01:47Z")
> [@syfwork](#):
>
> ```auto
> format => "json"
> message => '{"query": {"match": {"build_id": "%{[build_id]}"}}}'
>
> ```
My reading of the [code](https://github.com/logstash-plugins/logstash-output-http/blob/0fa6e39bbff5f06ab00d257e0102c757a5c06e82/lib/logstash/outputs/http.rb#L333) is that the message option is ignored if the format option is json. I think you should be using `format => "message"`. The [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html#plugins-outputs-http-format) seems to say that too.
---
### Author:  [@syfwork](https://discuss.elastic.co/u/syfwork)
#### Post date: [March 29, 2024, 2:20am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/3 "2024-03-29T02:20:50Z")
Hi,
After changing to `format => "message"`, got 409 return code:
```auto
Encountered non-2xx HTTP code 409
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2024, 2:40am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/4 "2024-03-29T02:40:44Z")
delete\_by\_query does a search for documents that match the query, then it iterates over that list of documents and deletes them. But it does a version check to make sure that the document has not been updated between the query and the delete. If it has been updated then it returns a 409 error and does not delete the document.
If you want to test the output then you can find a build\_id that you want to delete from elasticsearch, and replace your jdbc input with
```
input { generator { count => 1 message => '{"build_id": "XXX"}' codec => json } }
```
---
### Author:  [@syfwork](https://discuss.elastic.co/u/syfwork)
#### Post date: [March 29, 2024, 5:53am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/5 "2024-03-29T05:53:22Z")
Hi,
I'm sure there will only be a deleting request sent during this process, as it is just my local testing environment.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2024, 6:26am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/6 "2024-03-29T06:26:30Z")
Then I am out of ideas. I do not run elasticsearch, just logstash. Perhaps @stephenb or one of the other regulars can help.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 29, 2024, 2:16pm UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/7 "2024-03-29T14:16:37Z")
I think `message` is correct.
I think debugging the 409 is the next step.
I would do what @Badger suggested to debug and isolate.
Try 1 single known id.
---
### Author:  [@syfwork](https://discuss.elastic.co/u/syfwork)
#### Post date: [April 2, 2024, 2:49am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/8 "2024-04-02T02:49:27Z")
Hi,
I just tried and got a 406 return code.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 30, 2024, 2:49am UTC](https://discuss.elastic.co/t/error-encountered-non-2xx-http-code-400/356378/9 "2024-04-30T02:49:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.