Same code worked in previous version 7 but i have updated to latest version Elasticsearch logstash and kibana 7.17 , the logstash code is not working and getting error, i have been trying this from 15 days , When i have tested previous version it worked , please help to resolve the issue
[ERROR][logstash.codecs.json ][01359] JSON parse error, original
data now in message field {:message=>"Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (String)\"<html><head><title>Error</title></head><body>Internal Server Error</body></html>\"; line: 1, column: 2]", :exception=>LogStash::Json::ParserError, :data=>"<html><head><title>Error</title></head><body>Internal Server Error</body></html>"}
where i m doing wrong
input {
http_poller {
urls => {
se123 => {
method => get
url => "https://**/sitemangr/v1/group/8976789098"
headers => {
"Content-Type" => "application/json"
"Authorization" => "Bearer %{jghjklkhgewsklkjhgescvbnkltrezuikjhfdsxcjhgfv}"
}
}
}
request_timeout => 60
schedule => { "every" => "100s"}
codec => "json"
metadata_target => "http_poller_metadata"
}
}
output {
elasticsearch
{
user => user
password =>password
hosts => ["localhost:9200"]
index => "iiiii-%{+xxxx.ww}"
}
stdout { codec => rubydebug }
}
What does your [message] field look like? I suspect the http server, which you expect to be sending you JSON, is in fact sending you HTML, possibly an error message, in which case looking at the contents of the [message] field is your route to a solution.
In postman I get json result and in February I used to get the expected result with same logstash code. I am using the same code now getting the error . Does there any changes in new version , what modifications or any changes in syntax in http_poller input configuration?
Please let me know
It is a jboss server
[
{
"A": {},
"B": "543a",
"C": "Shafi",
"groupHierarchy": [
"Market",
"shafi GmbH",
"shafi_1-Business",
"System"
],
"D": [],
"E": [],
"F": [],
"G": {
"ref": "https://shafi/Manager/v1/groups/9865678909876545678a2b",
"id": "0987654567892b"
},
"H": {
"ref": "https://shafi/Manager/v1/users?groupid=9987786789865689fe56543a"
},
"I": null
}
]
{
"_index": "qes-2022.52",
"_type": "_doc",
"_id": "EFzyyjbAD9tX",
"_version": 1,
"_score": 1,
"_ignored": [
"http_poller_metadata.response_headers.content-security-policy.keyword",
"http_poller_metadata.request.headers.Authorization.keyword"
],
"_source": {
"@timestamp": "2022-12-27T03:53:49.452Z",
"message": "<html><head><title>Error</title></head><body>Internal Server Error</body></html>",
"tags": [
"_jsonparsefailure"
],
"@version": "1",
"http_poller_metadata": {
"host": "shafi-4",
"code": 500,
"runtime_seconds": 0.46305500000000005,
"response_message": "Internal Server Error",
"name": "se123",
That may be the problem. Please format your post by editing it, selecting the data (not the text) and clicking on </> in the toolbar above the edit panel.
It really matters. Without the </> both HTML/XML and special characters will be consumed as markup (bold, italics, etc.). Once we know what the error message is then we may be able to help.
This code worked previously and now not working , please tell me the differences in 7.17 and ealrier version , do i need to change anything
input {
http_poller {
urls => {
se12300 => {
method => get
url => "https://shafi.de/Manager/v1/group-associations/41bd4a570"
headers => {
"Content-Type" => "application/json"
"Authorization" => "Bearer %{aaaaaaaaaaaaaaaa}"
}
}
se1230000 => {
method => get
url => "https://shafi.de/Manager/v1/group-associations/4a1f1737336a"
headers => {
"Content-Type" => "application/json"
"Authorization" => "Bearer %{aaaaaaaaaaaaaaa}"
}
}
se1200399 => {
method => get
url => "https://shafi.de/Manager/v1/group-associations/3cac908beb3be"
headers => {
"Content-Type" => "application/json"
"Authorization" => "Bearer %{aaaaaaaaaaaaaa}"
}
}
}
request_timeout => 60
codec => "json"
type => "Http_poller"
schedule => { "every" => "100s"}
metadata_target => "http_poller_metadata"
}
}
filter {
date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss" ]
}
mutate { remove_field => ["A","B","C","D","parent","members","groupType"]
}
}
output {
elasticsearch
{
user => elastic
password => password
hosts => ["localhost:9200"]
index => "we-%{+xxxx.ww}"
}
stdout { codec => rubydebug }
}
OK, so that's HTML, not JSON. Look at the server logs to see what error it had.
previously it worked , now its not working with same logstash code
what is the difference in newer version 7.17 in http_poller plugin
i have used the same code earlier it worked
what should i do to work to work this code here , please help me
In postman i m getting json result, not getting what to do , no solution
from postman result i took in file and tried but getting same error result
please let me know what changes to do in my code to change as html
We have no way of knowing that. The server is getting an internal error. It probably logs an error message indicating what happened, you need to find that error message.
In Server below are the error
ERROR [io.undertow.request] (default task-224) UT005023: Exception handling request to /Manager/v1/group-associations/63d3-1e84-470e-94be-41b: java.lang.IllegalArgumentException: Illegal base64 character 25
at java.base/java.util.Base64$Decoder.decode0(Unknown Source)
The authentication token for Bearer authentication has to be base64 encoded. Apparently the token you are sending is not.
Is this bug from logstash in http_poller in 7.17
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.