# Http filter Vs elasticsearch ouput
**URL:** https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718
**Category:** Logstash
**Created:** [February 4, 2023, 10:32pm UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718 "2023-02-04T22:32:31Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)
#### Post date: [February 4, 2023, 10:32pm UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/1 "2023-02-04T22:32:31Z")
Hello,
I want to capture and process failures related to Elasticsearch being down and Elasticsearch output does not offer a way to handle this so, I want to do a POC and experiment with indexing events into Elasticsearch using the http filter instead of the Elasticsearch output so that I could use the "tags" field to know if a failure happened.
Assuming the POC will work functionally as expected using http filter, can I reach similar performance achieved by using Elasticsearch output (connection pooling, bulk requests, compression, etc.)?
Thanks
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 4, 2023, 11:16pm UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/2 "2023-02-04T23:16:31Z")
> [@mostafaelsayed](#):
>
> I want to capture and process failures related to Elasticsearch being down and Elasticsearch output does not offer a way to handle this so,
Have you looked at
> **[Dead letter queues (DLQ) | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html)**
---
### Author:  [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)
#### Post date: [February 4, 2023, 11:32pm UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/3 "2023-02-04T23:32:35Z")
Hi @stephenb
As I understand, The dead letter queue won't capture failures related to elasticsearch being down
It only captures 400 or 404 errors
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 4, 2023, 11:48pm UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/4 "2023-02-04T23:48:42Z")
logstash has an at-least-once delivery model. If elasticsearch is down then the regular queues will back up. If they fill up then logstash will stop processing events and reading the inputs.
---
### Author:  [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)
#### Post date: [February 5, 2023, 12:22am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/5 "2023-02-05T00:22:21Z")
Thanks @Badger I understand.
So using the http filter won't overcome the backing up issue? because the tags field in the event will indicate a failure
Or using http filter won't deliver good performance as the elasticsearch output and maybe I am misusing it?
What I am thinking of is after I find out a failure happened after the http filter, I would save this event somewhere else and a Cron job will do a health check and pick those up and try to index them again after elasticsearch is up again.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 5, 2023, 1:03am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/6 "2023-02-05T01:03:45Z")
> [@mostafaelsayed](#):
>
> Or using http filter won't deliver good performance as the elasticsearch output and maybe I am misusing it?
An elasticsearch sends a batch of events (perhaps 125) to elasticsearch in a single \_bulk API call. An http filter makes an API call for each event. The performance will be far worse.
If elasticsearch is down then events back up behind the output. The filter will get an error when one of the timeouts fires (all the timeouts are ten seconds by default). So you can detect it being down using the filter, but it is going to be slow.
---
### Author:  [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)
#### Post date: [February 5, 2023, 1:31am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/7 "2023-02-05T01:31:34Z")
Thanks @Badger
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 5, 2023, 2:01am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/8 "2023-02-05T02:01:34Z")
You can also monitor the elasticsearch endpoint with heartbeat or metricbeat every 10s, 5s or 1sec if you want and alert off it... Or any other tool..
---
### Author:  [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)
#### Post date: [February 5, 2023, 10:41am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/9 "2023-02-05T10:41:10Z")
Thanks @stephenb I will check this option.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 5, 2023, 10:41am UTC](https://discuss.elastic.co/t/http-filter-vs-elasticsearch-ouput/324718/10 "2023-03-05T10:41:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.