Logstash Dead Letter Queue


I've been trying to setup a dead letter queue

> [WARN ] 2019-03-27 10:19:14.917 [[main]>worker0] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"hpc-wa-2019.03.06", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x10a2bd76>], :response=>{"index"=>{"_index"=>"hpc-wa-2019.03.06", "_type"=>"doc", "_id"=>"syipvmkB7zoe6E2bN46B", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [0] of different type, current_type [text], merged_type [ObjectMapper]"}}}}

So Logstash is outputting to Elastic with an error 400

dead_letter_queue.enable: true
path.dead_letter_queue: /usr/share/logstash/data/dead_letter_queue

However it's not creating the DLQ log file

Checking the Logstash log, it mentioned that dead_letter_queue directory wasn't writable so I changed the permissions, but still no log file, is there something else I'm missing?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.