Logstash HTTP output plugin not reading metadata fields correctly for user/password fields, what am I doing wrong

Elastic Stack Logstash
1

This is my config:

filter {
		
        prune {
        blacklist_names => [ "timestamp", "path", "size", "@version", "host" ]
      }
	     
      uuid {
        target    => "[@metadata][snapshot][id]"
        overwrite => true
      
   }
   
   mutate {

	  add_field => { "[@metadata][snapshot][repo]" => "minio_test" }
	  add_field => { "[@metadata][elastic][host]" => "xxx" }
	  add_field => { "[@metadata][elastic][port]" => "xxx" }
	  add_field => { "[@metadata][elastic][protocol]" => "https"}
	  add_field => { "[@metadata][elastic][user]" => "xxx" }
	  add_field => { "[@metadata][elastic][password]" => xxx}
   }

}

output {

   http {

    follow_redirects => false
    http_method => "put"
	format => "json"
    url => "%{[@metadata][elastic][protocol]}://%{[@metadata][elastic][host]}:%{[@metadata][elastic][port]}/_snapshot/%{[@metadata][snapshot][repo]}/%{[@metadata][snapshot][id]}"
	user => "%{[@metadata][elastic][user]}"
	password => "%{[@metadata][elastic][password]}"

  }

}

This is output through stdout:

{
                 "indices" => "<blah>",
      "ignore_unavailable" => true,
               "@metadata" => {
            "path" => "<blah>",
         "elastic" => {
                "port" => "xxx",
                "host" => "xxx",
            "password" => "xxx",
            "protocol" => "https",
                "user" => "xxx"
        },
            "host" => "<blah>",
        "snapshot" => {
              "id" => "eedcb560-46b8-4486-9af8-4cdb42074111",
            "repo" => "minio_test"
        }
    },
    "include_global_state" => false
}

So it seems like the metadata fields are filled out properly by filter mutate plugin, however on REST endpoint side, I see:

"message": "Authentication finally failed for %{[@metadata][elastic][user]}

So it seems like the http output user field is not being filled in properly with data in [@metadata] when I try to use it in HTTP output plugin.

Funnily enough, the url field gets filled in with [@metadata] fields perfectly.

When I just used string literal to fill out user/password fields, it works perfectly.

What am I doing wrong?

2

The code does not sprintf the user and password options. It does sprintf the url, so this is working as expected.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.