# Logstash Elasticsearch filter Bad URI Exception **URL:** \ **Category:** Logstash\ **Created:** [January 14, 2023, 1:08pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176 "2023-01-14T13:08:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 14, 2023, 1:08pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/1 "2023-01-14T13:08:43Z")
Hello Everyone. I have an exception in Logstash with Elasticsearch filter in the **hosts** parameter. When i give manually the **hosts** parameter like this, all thing is good, i don't get error : ```auto filter { elasticsearch { hosts => ["https://server_ip:9201", "https://server_ip:9202", "https://server_ip:9203"] user => "${USERNAME}" password => "${PASSWORD}" ca_file => "${CERT_FILE}" query => "field1:%{[field1]}" index => "index01" result_size => 1 fields => { "some_field" => "some_field" } } } ``` But when i am getting the hosts parameter from the .env file like this, i got a **bad URI exception** : ```auto filter { elasticsearch { hosts => "${HOSTS}" user => "${USERNAME}" password => "${PASSWORD}" ca_file => "${CERT_FILE}" query => "field1:%{[field1]}" index => "index01" result_size => 1 fields => { "some_field" => "some_field" } } } ``` Here is the .env file : ```auto HOSTS=["https://server_ip:9201", "https://server_ip:9202", "https://server_ip:9203"] USERNAME=username PASSWORD=password CERT_FILE=/path/to/cert ``` I have tried many options for the **HOSTS** parameter in the .env like this without result : - ["https://server\_ip:9201", "https://server\_ip:9202", "https://server\_ip:9203"] - ["https://server\_ip:9201" "https://server\_ip:9202" "https://server\_ip:9203"] - ['https://server\_ip:9201', 'https://server\_ip:9202', 'https://server\_ip:9203'] - ['https://server\_ip:9201' 'https://server\_ip:9202' 'https://server\_ip:9203'] - "https://server\_ip:9201, https://server\_ip:9202, https://server\_ip:9203" - "https://server\_ip:9201 https://server\_ip:9202 https://server\_ip:9203" Here is the full log from Logstash : ```auto {"level":"ERROR","loggerName":"logstash.javapipeline","timeMillis":1673718151626,"thread":"[test]-pipeline-manager","logEvent":{"message":"Pipeline error","pipeline_id":"test","exception":{"metaClass":{"metaClass":{"metaClass":{"exception":"bad URI(is not URI?): https://192.15.10.0:9201 https://192.15.10.0:9202 https://192.15.10.0:9203","backtrace":["/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/uri/rfc3986_parser.rb:67:in `split'","/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/uri/common.rb:199:in `split'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-7.17.1/lib/elasticsearch/transport/client.rb:312:in ` __parse_host'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-7.17.1/lib/elasticsearch/transport/client.rb:302:in `block in__ extract_hosts'","org/jruby/RubyArray.java:2589:in `map'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-7.17.1/lib/elasticsearch/transport/client.rb:302:in `__extract_hosts'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-7.17.1/lib/elasticsearch/transport/client.rb:154:in `initialize'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-7.17.1/lib/elasticsearch.rb:35:in `initialize'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch/client.rb:37:in `initialize'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch.rb:218:in `new_client'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch.rb:222:in `block in get_client'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch.rb:222:in `get_client'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch.rb:330:in `test_connection!'","/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.12.0/lib/logstash/filters/elasticsearch.rb:118:in `register'","org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:233:in `block in register_plugins'","org/jruby/RubyArray.java:1821:in `each'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:232:in `register_plugins'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:599:in `maybe_setup_out_plugins'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:245:in `start_workers'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:190:in `run'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:142:in `block in start'"],"pipeline.sources":["/usr/share/logstash/pipeline/test/conf.d/10-test-input.conf","/usr/share/logstash/pipeline/test/conf.d/20-test-filters-01.conf","/usr/share/logstash/pipeline/test/conf.d/20-test-filters-02.conf","/usr/share/logstash/pipeline/test/conf.d/20-test-filters-03.conf","/usr/share/logstash/pipeline/test/conf.d/30-test-output.conf"],"thread":"#"}}}}}} ``` Can someone help me please with this issue ? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 14, 2023, 1:28pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/2 "2023-01-14T13:28:46Z")
Please share the full log from Logstash. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 14, 2023, 3:15pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/3 "2023-01-14T15:15:58Z")
Check [this topic](https://discuss.elastic.co/t/how-to-use-environment-variable-for-logstash-output-elasticsearch-plugin-for-multiple-elasticsearch-hosts/317169) ---
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 14, 2023, 5:55pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/4 "2023-01-14T17:55:45Z")
I update the post with the full log ---
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 14, 2023, 5:56pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/5 "2023-01-14T17:56:58Z")
This work for elasticsearch output, but don't work for the filter. I am using the elasticsearch filter. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 14, 2023, 6:15pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/6 "2023-01-14T18:15:33Z")
The correct way to declare multiple hosts in an environment variable is the last one you shared, with a space between the hosts. Something like this ```auto ES_NODES="https://host-01:9200 https://host-02:9200 https://host-03:9200" ``` For the `elasticsearch` output you would use the hosts like this: ```auto hosts => ["${ES_NODES}"] ``` I would expect that this should work as well in the Elasticsearch filter, but in your filter configuration you used like this: ```auto hosts => "${HOSTS}" ``` Try to change into this to see if it will work. ```auto hosts => ["${HOSTS}"] ``` ---
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 14, 2023, 6:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/8 "2023-01-14T18:33:41Z")
Thank for your reply. I try but get the same error ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 14, 2023, 6:34pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/9 "2023-01-14T18:34:23Z")
> [@eraste](#): > > This work for elasticsearch output, but don't work for the filter. That is correct. The PR that enables use of multi-valued environment variables is specific to options declared as :uri. The output uses [:uri](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/89a0fe9239f86cec2c179968b16671eee1e026ef/lib/logstash/plugin_mixins/elasticsearch/api_configs.rb#L161), the filter uses an [array of strings](https://github.com/logstash-plugins/logstash-filter-elasticsearch/blob/6ff00f054628cba4bac9224e0787f94239e784d2/lib/logstash/filters/elasticsearch.rb#L14). URIs cannot contain spaces, so that can be used as a separator for multiple values, that is not true of strings. ---
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 14, 2023, 6:37pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/11 "2023-01-14T18:37:53Z")
Yeah thank you, so how can i fix this issue ? Or what can i use as separator for the array string ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 14, 2023, 7:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/12 "2023-01-14T19:02:12Z")
> [@eraste](#): > > so how can i fix this issue ? I don't think you can. You can only pass the filter a single host using an environment variable. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 11, 2023, 7:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176/13 "2023-02-11T19:02:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.