# Illegal character in authority at index 8:

**URL:** <https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795>\
**Category:** Logstash\
**Created:** [August 4, 2020, 11:29pm UTC](https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795 "2020-08-04T23:29:50Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 5, 2020, 1:31am UTC](https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795/5 "2020-08-05T01:31:30Z")

</div>

I think you've run into an issue that seems to have been open for a while…

> [@Logstash-filter-elasticsearch URI parsing error when ssl set to true](https://discuss.elastic.co/t/logstash-filter-elasticsearch-uri-parsing-error-when-ssl-set-to-true/163814/2):
>
> Specify all hosts with their https:// prefix and do not specify the ssl attribute.

> [@Illegal Character Authority Error Elasticsearch Filter](https://discuss.elastic.co/t/illegal-character-authority-error-elasticsearch-filter/190825):
>
> When performing an Elasticsearch filter query, I get the below error (I've replaced sensitive values with an equivilent number of Xs. [WARN][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=\>"servicenow-\*", :error=\>"Illegal character in authority at index 8: https://{:host=\>\"xxxxxxxxx.xxxxxxxxx.net:9200\", :scheme=\>\"https\", :protocol=\>\"https\", :port=\>9200}:9200/servicenow-%2A/\_search?q=number%3AXXX0029703&size=1&sort=%40timestamp%3Adesc"} What does…

> <https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues/129>
>
> I' trying to use this filter plugin. When i run the it with logstash 7.6.2 and n…ewest filter version 3.7.1, I receive the following error:
> 
> \`\[WARN \] 2020-04-16 09:05:18.073 \[\[main\]\>worker1\] elasticsearch - Failed to query elasticsearch for previous event {:index=\>"proxy-blacklist", :error=\>"Illegal character in authority at index 8: https://{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>{:host=\>\\"elastic01.example.org\\", :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\", :protocol=\>\\"https\\", :port=\>9200}, :scheme=\>\\"https\\"}, :scheme=\>\\"https\\"}:9200/proxy-blacklist/\_search?q=domain.keyword%3A%2F%28www.%29%3Fchat.example.org%2F&size=1&sort=%40timestamp%3Adesc"}\`
> 
> So it comes down to:
> 
> \`Illegal character in authority at index 8\`
> 
> I've found many users which seem to have this problem but no solution at all. Some solve this by not using "ssl =\> true" and using the prefix "https://" in the hosts section instead. This does not solve the error for me. My filter config looks like this:
> 
> 
> \> filter {
> \> grok {
> \> patterns\_dir =\> \["/etc/logstash/patterns/patterns" \]
> \> match =\> \["message", "%{SQUIDACCESS}" \]
> \> }
> \> elasticsearch {
> \> hosts =\> \["elastic.example.org" \]
> \> user =\> "elastic"
> \> password =\> "changeme"
> \> ssl =\> true
> \> ca\_file =\> "/etc/logstash/ca.crt"
> \> index =\> "blacklist"
> \> query =\> "domain.keyword:/(www.)?%{zone}/"
> \> fields =\> { "domid" =\> "domid" }
> \> fields =\> { "source" =\> "source" }
> \> }
> \> }

---

_[View the full topic](https://discuss.elastic.co/t/illegal-character-in-authority-at-index-8/243795)._