Logstash pipeline Http output plugin error "[HTTP Output Failure] Encountered non-2xx HTTP code 400"

Elastic Stack Logstash
1

Hi all,

I have a logstash output http plugin:

output {

    if [@metadata][index_to_delete] == "first_index" or [@metadata][index_to_delete] == "second_index" {
        http {
         id => "http_index_delete"
         url => "https://HOST:9200/%{[@metadata][index_to_delete]}"
         http_method => "delete"
         cacert => 'mycert.cer'
         user => "user_with_delete_index_right"
         password => "mypass"
        }
    }
}

An I get this error:

[2023-07-11T16:15:03,083][ERROR][logstash.outputs.http    ][main][http_index_delete] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>"https://HOST:9200/second_index", :event=>#<LogStash::Event:0x453a6b91>}

It is a bad request to elasticsearch.
How can I solve it? Is it because of credentials? Thank you

Edit: Logstash version 7.17

2

After days of checking for a solution, I found out that it is a known bug (open issue) in http plugin in logstash output:
Link to Github repo http output plugin

I found a workaround. I used http plugin in the filter section:

filter {
  if [@metadata][index_to_delete] == "first_index" or [@metadata][index_to_delete] == "second_index" {
          http {
           id => "http_index_delete"
           url => "https://HOST:9200/%{[@metadata][index_to_delete]}"
           verb => "DELETE"
           cacert => 'mycert.cer'
           user => "user_with_delete_index_right"
           password => "mypass"
          }
      }
}

It deleted my index in elasticsearch but tried again afterwards. I need to create an if condition to do it once.
The only difference between filter http plugin and output http plugin is:

verb => "DELETE"

instead of

http_method => "delete"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.