Logstash altering defined Elasticsearch URL


I have my Logstash configured with the following output:

output {
    hosts => ["http://myhost/elasticsearch"]

This is a valid URL, as I can cURL commands to Elasticsearch with it, such as

curl "http://myhost/elasticsearch/_cat/indices?v"

returns my created indices.

However, when Logstash attempts to create a template, it uses the following URL:


when I would expect it to use


It appears that the /elasticsearch portion of my URL is being chopped off. What's going on here? Is "elasticsearch" a reserved word in the URL that is removed? As far as I can tell, when I issue http://myhost/elasticsearch/elasticsearch, it attempts to find an index named "elasticsearch" which leads me to believe it isn't reserved.

Any help would be greatly appreciated, thanks!

  • Chris

I am using Logstash and Elasticsearch 5.0.0

I have found the following issue:

It seems a similar thing happens when querying Elasticsearch from Kibana; elasticsearch is a Kibana proxy to Elasticsearch. Does this also happen to be the case with Logstash?


Upon changing the endpoint URL to be


Logstash is still attempting to access


What might be the problem?

Try using the proxy config option.
Or proxy and path
Or hosts and path

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.