-
Notifications
You must be signed in to change notification settings - Fork 3.5k
Description
Logstash information:
Logstash version (e.g. bin/logstash --version
): 8.17.6
Description of the problem including expected versus actual behavior:
Since the version 8.17.3
, HTTP 404
error responses are handled as an empty pipeline list when using CPM to manage logstash configuration (see #17052).
It seems the new logic is only checking for HTTP 404 response codes to determine whether the managed pipeline list is empty, making it unreliable as HTTP 404 is a generic error and might happen in other situation as well, such as unknown Elasticsearch nodes (due to outages, for example). When that happens, pipelines are shutdown.
A possible solution would be improving the empty result detection maybe by also checking if the body is empty {}
(returned by an Elasticsearch instance), or if it's another type of error, e.g. {"ok":false,"message":"Unknown resource."}
returned by the gateway/API.
Steps to reproduce:
- Configure LS with managed configuration
- Start Logstash
- Turn the node down or simulate an 404 response