I could not find the solution but have a workaround for this. I have fresh installation of logstash 5.6.3 and using logstash-output-elasticsearch plugin version 9.0.0(upgraded from 7.4.2)
Error:
[2017-10-11T06:52:46,492][ERROR][logstash.outputs.elasticsearch] Encountered an unexpected error submitting a bulk request! Will retry. {:error_message=>"undefined method sanitized' for \"/_bulk\":String", :cl ass=>"NoMethodError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/common.rb:250:insafe_bulk'", "/usr/share/logsta
sh/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsearch/common.rb:113:in submit'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elastics earch-9.0.0-java/lib/logstash/outputs/elasticsearch/common.rb:81:inretrying_submit'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-9.0.0-java/lib/logstash/outputs/elasticsea
rch/common.rb:33:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:13:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegat
or.rb:49:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:434:inoutput_batch'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeli ne.rb:433:inoutput_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:381:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:instart_workers'"]}
This occurs during error handling and url sanitisation method in mentioned ruby file common.rb line 250:
Changed
log_hash = {:code => e.response_code, :url => e.url.sanitized.to_s}
to
log_hash = {:code => e.response_code, :url => e.url, :body => e.response_body }
Now that I am not sanitizing url, hence getting below appropriate message in logs:
[2017-10-11T07:14:25,097][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>404, :url=>"/_bulk", :body=>"{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index and [action.auto_create_index] ([prod*,.security,.monitoring*,.watches,.triggered_watches,.watcher-history*]) doesn't match","index_uuid":"na","index":"logstash-2017.10.11"}],"type":"index_not_found_exception","reason":"no such index and [action.auto_create_index] ([prod*,.security,.monitoring*,.watches,.triggered_watches,.watcher-history*]) doesn't match","index_uuid":"na","index":"logstash-2017.10.11"},"status":404}"}
This was the error due to configuration in elasticsearch.yml file which allowed only certain index pattern to be created automatically. Changed configuration in yml and finally index was created.