Hi,
I've been trying to setup a dead letter queue
> [WARN ] 2019-03-27 10:19:14.917 [[main]>worker0] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"hpc-wa-2019.03.06", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x10a2bd76>], :response=>{"index"=>{"_index"=>"hpc-wa-2019.03.06", "_type"=>"doc", "_id"=>"syipvmkB7zoe6E2bN46B", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [0] of different type, current_type [text], merged_type [ObjectMapper]"}}}}
So Logstash is outputting to Elastic with an error 400
dead_letter_queue.enable: true
path.dead_letter_queue: /usr/share/logstash/data/dead_letter_queue
However it's not creating the DLQ log file
Checking the Logstash log, it mentioned that dead_letter_queue directory wasn't writable so I changed the permissions, but still no log file, is there something else I'm missing?