HTTP Output Failure - Unable to send logstash output to elasticsearch

[Vivek_Sharma]

Hi

I am trying to parse a text file containing 3 fields and storing the result in elasticsearch using http.

Below is the code I have created for this.

input {
  beats {
    port => 5044
	}
}

filter { 
		dissect {
				mapping => { 
					message => "%{empid}##%{empname}##%{hrsworked}" }
			}
}
output {
        http {
            url => "http://localhost:9200/pocind-%{+YYYY.MM.dd}/_doc/%{empid}/_update?retry_on_conflict=5"
            http_method => "post"
            content_type => "application/json"
            format => "message"
            message => '{  
                "script" : {
                    "source": " ctx._source.SAGStatus.add(params.status)" ; ctx._source.SAGTimestampIn = params.timestamp",
                        "lang": "painless",
                        "params" : {
                            "status" : "Viveks",
                        }
                    },
                "upsert" : {"Employee Id" : "%{empid}", "Employee Name" : "%{empname}","Hrs Worked" : "%{hrsworked}", "Emp Status" : ["status"]}
            }'
        }
}

But when I parse the logs, i get error as below:

`

`

[2019-07-11T15:28:54,669][ERROR][logstash.outputs.http ] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>"http://localhost:9200/pocind-2019.07.11/_doc/305611/_update?retry_on_conflict=5", :event=>#LogStash::Event:0x257029}

`
Can anyone please help in on how to get this issue resolved.

Thanks
Vivek Sharma
`

[Badger]

If elasticsearch is returning an error there is probably a more informative message in the elasticsearch logs.

Can I ask why you are trying to write to elasticsearch using an http output rather than an elasticsearch output?