saved_object/_bulk_create expects to get an array of JSON objects. The json_lines codec will encode a single JSON object. _bulk_create will not accept that. You could try something like
Of course this assumes that your event is a valid object, which seems unlikely, since logstash may have added fields to the event (e.g. @timestamp) that kibana is not expecting.
I have added the above entries, but still not working.
I dont see any errors in logstash and started successfully.
but I dont see any entries in the log that messages are dropping, I am trying to understand where the messages are dropping.
I am trying to create multiple objects by sending json form of kibana objects to kibana api.
please help and let me know if I am missing anything else.
please let me know how can I drop the fields that are added by logstash.
Thanks for reply,
I am able to remove those fields.
now I am able to see the message body in the log file and compared with the input json data.
I found one additional field "tags":["_rubyexception"]}" in the body and found the below error.
Please advise.
:message=>"XXXXXXXXXXXXXXXXXXXXXXXXXXX:5601 failed to respond", :class=>"Manticore::ClientProtocolException", :backtrace=>["/opt/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in block in initialize'", "/opt/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:79:in call'", "/opt/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-http-5.2.4/lib/logstash/outputs/http.rb:239:in send_event'", "/opt/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-http-5.2.4/lib/logstash/outputs/http.rb:175:in send_events'", "/opt/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-http-5.2.4/lib/logstash/outputs/http.rb:124:in multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:118:in multi_receive'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:101:in multi_receive'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:390:in block in output_batch'", "org/jruby/RubyHash.java:1419:in each'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:389:in output_batch'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:341:in worker_loop'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:304:in block in start_workers'"], :will_retry=>true}
I have removed the ruby filter and removed the _rubyexception tag.
Now the message body is matching with input json.
but still I am getting 'failed to respond' error.
Please advise if there is any other options I need to try.
Please let me know if anyone facing same kind of issue,
I am able to create saved objects by ingesting the json format into saved_objects Kibana api with curl command. but when I use logstash to do the same job using http output plugin, it is failing.
Appreciated help.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.