Skip to content

Unexpected pipeline shutdown with central-managed configurations #17980

@edmocosta

Description

@edmocosta

Logstash information:

Logstash version (e.g. bin/logstash --version): 8.17.6

Description of the problem including expected versus actual behavior:
Since the version 8.17.3, HTTP 404 error responses are handled as an empty pipeline list when using CPM to manage logstash configuration (see #17052).

It seems the new logic is only checking for HTTP 404 response codes to determine whether the managed pipeline list is empty, making it unreliable as HTTP 404 is a generic error and might happen in other situation as well, such as unknown Elasticsearch nodes (due to outages, for example). When that happens, pipelines are shutdown.

A possible solution would be improving the empty result detection maybe by also checking if the body is empty {} (returned by an Elasticsearch instance), or if it's another type of error, e.g. {"ok":false,"message":"Unknown resource."} returned by the gateway/API.

Steps to reproduce:

  1. Configure LS with managed configuration
  2. Start Logstash
  3. Turn the node down or simulate an 404 response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions