# Logstash http output not working

**URL:** <https://discuss.elastic.co/t/logstash-http-output-not-working/203822>\
**Category:** Logstash\
**Created:** [October 16, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-http-output-not-working/203822 "2019-10-16T11:29:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sariel1212](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@sariel1212](https://discuss.elastic.co/u/sariel1212)\
**Post date:** [October 16, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-http-output-not-working/203822/1 "2019-10-16T11:29:41Z")

</div>

Hi,  
I'm trying to forward logs from logstash to Splunk using http,  
and this is my logstash.conf file:

input {  
file {  
path =\> "${TEST\_INPUT\_PATH}"  
start\_position =\> "beginning"  
}  
}

output {  
http {  
http\_method =\> "post"  
url =\> "{TEST\_URL}" headers =\> ["Authorization", "{TEST\_SPLUNK\_AUTH}"]  
mapping =\> {  
"event" =\> "%{[message]}"  
"sourceType" =\> "aoflow\_acct\_add"  
}  
}  
}

in each change in ${TEST\_INPUT\_PATH} file the logs supposed to be sent to Splunk.  
The problem is that in each http out, I get this error:

[2019-10-16T11:14:44,407][ERROR][logstash.outputs.http] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response\_code=\>400, :url=\>"[http://172.17.0.4:8088/services/collector/event](http://172.17.0.4:8088/services/collector/event)", :event=\>#LogStash::Event:0x3252cdd2}

This is the event data:  
{  
"path" =\> "/usr/share/logstash/log-test/log.txt",  
"@timestamp" =\> 2019-10-16T11:14:42.652Z,  
"@version" =\> "1",  
"host" =\> "test-7669c9ddc4-zbthj",  
"message" =\> "The time is: 1571224474807 "  
}

- I tried to curl to this url and with this token and it worked.
- I tried to just stdout the input and it worked

so I guess something is wrong with my configuration of the http output.  
Where am I getting wrong?

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-http-output-not-working/203822/2 "2019-11-13T11:29:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.