Hey Guys,
I have been trying to fetch data from serviceNow through logstash http_poller method, i was able to achieve when elasticsearch is on premise.
When i try to use the same method to send data to elasticsearch cloud i'm getting below error.
Error File
][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Template file '' could not be found!", :class=>"ArgumentError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch/template_manager.rb:31:in read_template_file'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch/template_manager.rb:17:inget_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch/template_manager.rb:7:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch/common.rb:57:ininstall_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch/common.rb:26:in register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:inregister'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:42:in register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:341:inregister_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:352:in block in register_plugins'", "org/jruby/RubyArray.java:1734:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:352:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:735:inmaybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:362:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:289:inrun'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:249:in `block in start'"]}
Here is my config file
input {
http_poller {
urls => {
url => "https://demo1.service-now.com/api/now/table/incident?sysparm_display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Clocation%2Copened_by%2Csys_created_on%2Cstate%2Cpriority%2Ccaller_id%2Cshort_description%2Cassignment_group%2Cassigned_to"
}
request_timeout => 60
proxy => { host => "1.1.1.9" port => "9898" scheme => "http"}
user => ""
password => ""
schedule => { cron => "* * * * "}
codec => "json"
metadata_target => "http_poller_metadata"
}
}
filter
{
split
{
field => "result"
}
}
output {
elasticsearch {
hosts => ["https://********0e9.ap-southeast-1.aws.found.io:9243"]
user => ""
password => "*"
index => "snow"
document_type => "doc"
}
}
We dont have direct internet access so we are using proxy in the config file for connecting to serviceNow, do i need to add any proxy to output file for connecting the elasticsearch cloud?
I have made proper input in logstash.yml file as well.
Please advice.
Thanks
Gautham