# Failed action with response of 400, dropping action: \["index"
**URL:** https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013
**Category:** Logstash
**Created:** [July 7, 2015, 6:50am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013 "2015-07-07T06:50:16Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)
#### Post date: [July 7, 2015, 6:50am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013/1 "2015-07-07T06:50:16Z")
Hello,
I have configured LS indexer output as below:
output {
elasticsearch {
host =\> "10.211.10.32"
cluster =\> "presit-elasticsearch"
node\_name =\> "presit-data-Node-2"
index =\> "%{ **type** }-%{+YYYY.MM.dd}"
}
**type** is the field set in LSF configuration under "Fields" array on client machine.
when I start logstash with above output configuration it shows error:
failed action with response of 400, dropping action: ["index"
whats wrong with LS configuration?
br,
Sunil.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 7, 2015, 7:38am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013/2 "2015-07-07T07:38:16Z")
> node\_name =\> "presit-data-Node-2"
This sounds like the name the Elasticsearch node has in the ES cluster. If that's the case the Logstash shouldn't join the node under the same name. Either way you don't have to set `node_name`. Drop it for now until we've made sure things work okay.
> when I start logstash with above output configuration it shows error:
> failed action with response of 400, dropping action: ["index"
That error message is truncated. Please post the full message. The ES logs might contain clues too.
---
### Author:  [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)
#### Post date: [July 7, 2015, 10:25am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013/3 "2015-07-07T10:25:55Z")
Hi Magnus,
Thanks for help.
I removed the node\_name from output and second problem was that index names were in capital. it should me lower case, so 400 error is solved. I can create index names from {type}.
Regarding node\_name: if I don't give node\_name, LS creates new one with the name "logstash-{hostname}-{someNumber}", but sends data to the node which mentioned in ES.yml why does it created new node?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 7, 2015, 10:41am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013/4 "2015-07-07T10:41:31Z")
> Regarding node\_name: if I don't give node\_name, LS creates new one with the name "logstash-{hostname}-{someNumber}", but sends data to the node which mentioned in ES.yml why does it created new node?
Yes, this is expected. See the documentation of the elasticsearch output's [node parameter](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-protocol):
> The _node_ protocol (default) will connect to the cluster as a normal Elasticsearch node (but will not store data).
In other words, Logstash becomes part of the ES cluster. This should be the most performant configuration but could have other drawbacks. For example, if you don't want to open up for all machines in your network to join the cluster you need to add firewall rules that allow access for Logstash nodes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013/5 "2017-07-06T05:35:24Z")