Logstash http output to Elasticsearch don`t work if both http and https applied

Elastic Stack Logstash
1

input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => ["https://localhost:9200","https://1.2.3.4:9200","https://2.3.4.5:9200"]
ssl_certificate_verification => "false"
index => "dev-%{[beat.version]}-%{+yyyy.MM.dd}"
user => "elastic"
password => "pass"
}
}

Error
[2019-04-30T16:15:06,725][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: Explicit value for 'scheme' was declared, but it is different in one of the URLs given! Please make sure your URLs are inline with explicit values. The URLs have the property set to 'http', but it was also set to 'https' explicitly>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:188:in calculate_property'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:219:inscheme'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:72:in build_url_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:62:ininitialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:103:in create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:99:inbuild'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch.rb:238:in build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:25:inregister'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:106:in register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:48:inregister'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:inblock in register_plugins'", "org/jruby/RubyArray.java:1792:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:inregister_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:611:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:280:instart_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:inblock in start'"], :thread=>"#<Thread:0x4950a372 run>"}

2

That error message is expected if one of the entries in the hosts option of the elasticsearch has http whilst the others have https.

3

I`m understand that but I need to set up both http and https. Any way to do that?

4

Use two outputs?

5

Use two different (http and https) outputs together.

6

Yes.

7

Any idea how can I do that?

8 
output {
    elasticsearch {
        hosts => ["https://1.2.3.4:9200/"]
        ssl_certificate_verification => "false"
        index => "dev-%{[beat.version]}-%{+yyyy.MM.dd}"
        user => "elastic"
        password => "pass"
    }
    elasticsearch {
        hosts => ["http://1.2.3.4:9200/"]
        index => "dev-%{[beat.version]}-%{+yyyy.MM.dd}"
        user => "elastic"
        password => "pass"
    }
}
1 Like
9

Thx!

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.