Logstash load my template failed with bad response error code 400

Elastic Stack Logstash
1

Hi Experts,

I have designed a customized template will be loaded during start logstash. But logstash loads it failed with error code 400. The failed report shows as below:

[2019-10-23T14:33:27,893][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"lsh*_nokiasbc-", "settings"=>{"index.refresh_interval"=>"5s"}, "default"=>{"total_fields"=>{"limit"=>"3000"}}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "omit_norms"=>true}, "dynamic_templates"=>[{"message_field"=>{"match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"string", "index"=>"analyzed", "omit_norms"=>true}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"string", "index"=>"analyzed", "omit_norms"=>true, "fields"=>{"raw"=>{"type"=>"string", "index"=>"not_analyzed", "ignore_above"=>256}}}}}], "properties"=>{"@version"=>{"type"=>"string", "index"=>"not_analyzed"}, "application"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "hostname"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "level"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "class"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "method"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "thread"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "syslog_program"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "syslog_hostname"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "eventid"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "module"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "errortype"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "src"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "sev"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "geoip"=>{"type"=>"object", "dynamic"=>true, "properties"=>{"location"=>{"type"=>"geo_point"}}}}}}}}
[2019-10-23T14:33:27,966][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/nokiasbcsig
[2019-10-23T14:33:28,056][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://localhost:9200/_template/nokiasbcsig'", :class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>["/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in perform_request_to_url'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:278:in block in perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in with_connection'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:277:in perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in block in Pool'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:348:in template_put'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in template_install'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:21:in install'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:9:in install_template'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/common.rb:118:in install_template'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/common.rb:49:in block in install_template_after_successful_connection'"]}

Here is the output part of code in my logstash pattern.

output {

        stdout {
                codec => rubydebug
        }

        elasticsearch {
                hosts => ["localhost:9200"]
                ssl => false
                template =>  '/home/admin/logtool/logpattern/template/elasticsearch-template-nokiasbc.json'
                template_overwrite => true
                template_name => 'nokiasbcsig'
                index => "lsh_nokia_nokiasbcsig-%{+YYYY.MM.dd}"
        }
}

Would you please help me check the load failed issue?

Thank you.

2

Additionally, here is the content of my template:

{
    "template": "lsh*_nokiasbc-*",
    "settings": {
        "index.refresh_interval": "5s"
    },
    "default": {
        "total_fields": {
            "limit": "3000"
        }
    },
    "mappings": {
        "_default_": {
            "_all": {
                "enabled": true,
                "omit_norms": true
            },
            "dynamic_templates": [{
                "message_field": {
                    "match": "message",
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "string",
                        "index": "analyzed",
                        "omit_norms": true
                    }
                }
            }, {
                "string_fields": {
                    "match": "*",
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "string",
                        "index": "analyzed",
                        "omit_norms": true,
                        "fields": {
                            "raw": {
                                "type": "string",
                                "index": "not_analyzed",
                                "ignore_above": 256
                            }
                        }
                    }
                }
            }],
            "properties": {
                "@version": {
                    "type": "string",
                    "index": "not_analyzed"
                },
            "application": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "hostname": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "level": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "class": { "type": "string", "index": "not_analyzed", "doc_values" : true },
                "method": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "thread": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "syslog_program": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "syslog_hostname": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "eventid": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "module": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "errortype": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "src": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "sev": { "type": "string", "index": "not_analyzed", "doc_values" : true },

                "geoip": {
                    "type": "object",
                    "dynamic": true,
                    "properties": {
                        "location": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.