Logstash Dead Letter Queue

Elastic Stack Logstash
1

Hi,

I've been trying to setup a dead letter queue

> [WARN ] 2019-03-27 10:19:14.917 [[main]>worker0] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"hpc-wa-2019.03.06", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x10a2bd76>], :response=>{"index"=>{"_index"=>"hpc-wa-2019.03.06", "_type"=>"doc", "_id"=>"syipvmkB7zoe6E2bN46B", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [0] of different type, current_type [text], merged_type [ObjectMapper]"}}}}

So Logstash is outputting to Elastic with an error 400

dead_letter_queue.enable: true
path.dead_letter_queue: /usr/share/logstash/data/dead_letter_queue

However it's not creating the DLQ log file

Checking the Logstash log, it mentioned that dead_letter_queue directory wasn't writable so I changed the permissions, but still no log file, is there something else I'm missing?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.