Logstash http_poller "read time out" on http 200 response

Elastic Stack Logstash
1

So I got this pipeline in logstash using http_poller and it works when the client is responding with a 401, but It breaks when it responses with a 200 with a little bit of data.

These request also do work with curl from the logstash host. Anybody any idea what it could be?

# testing this

input {
  http_poller {
    urls => {
     api  => {
        method => post
        url => "https://salt:8080/run"
        headers => {
          Accept => "application/x-yaml"
        }
        body =>'[{"client":"local","tgt":"win*","fun":"test.echo","token":"0317a0db839100e5df8b1e902ffd8515f44a38dad1716c7d5ae8e17f846d4b5c"}]'
      }
    }
    request_timeout => 60

    ssl_verification_mode => "none"
    #client_cert => "/etc/logstash/certs.d/cert.pem"
    #client_key => "/etc/logstash/certs.d/key.pem"
    schedule => {cron => "*/1 * * * * UTC"}
    codec => "line"

  }
}

output {
  stdout {
    codec => rubydebug
  }
}

The outlut:

{
      "@version" => "1",
          "tags" => [
        [0] "_http_request_failure"
    ],
         "event" => {
        "duration" => 10563358
    },
         "error" => {
        "stack_trace" => nil,
            "message" => "Read timed out"
    },
    "@timestamp" => 2022-10-12T07:54:10.690863554Z,
           "url" => {
        "full" => "https://salt:8080/run"
    },
          "host" => {
        "hostname" => "salt-logstash01"
    },
          "http" => {
        "request" => {
            "method" => "post"
        }
    }
}'
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.