ES with plugin OMELASTICSEARCH (rsyslog) Content type detection for rest requests is deprecated

Hello

I work with Elasticsearch 5.2 with OMELASTICSEARCH RSYSLOG plugin in RH EL 7.3.
Plugin version is : rsyslog-elasticsearch-7.4.7-16
It works well , but log file : elasticsearch_deprecation.log fills every second with :

// Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header //

The content of RSYSLOG configuration file is:

module(load="omelasticsearch") # for outputting to Elasticsearch
# this is for index names to be like: logstash-YYYY.MM.DD
template(name="logstash-index"
  type="list") {
    constant(value="logstash-")
    property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
}

# this is for formatting our syslog in JSON with @timestamp
template(name="plain-syslog"
  type="list") {
    constant(value="{")
      constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"host\":\"")        property(name="hostname")
      constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
      constant(value="\",\"tag\":\"")         property(name="syslogtag" format="json")
      constant(value="\",\"message\":\"")     property(name="msg" format="json")
      constant(value="\"}")
}

# this is where we actually send the logs to Elasticsearch (localhost:9200 by default)
action(type="omelasticsearch"
    server="localhost"
    serverport="9200"
    template="plain-syslog"
    searchIndex="logstash-index"
    dynSearchIndex="on"
    bulkmode="on"  # use the bulk API
    action.resumeretrycount="-1"  # retry indefinitely if Logsene/Elasticsearch is unreachable
)

I do not understand, under theese conditions, from where this message can come which slows down the machine.

Could you help me?

Thank you.

Pierre S.

Probably you need to ask this on the project http://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html.

Probably it needs to be updated. Check if you have a more recent version.

Content-Type must now be set...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.