How to see the DLQ messages in logstash?

564 Views Asked by At

I've configured the dead letter queue in logstash

Logasth.yml

 dead_letter_queue.enable: true

I didn't configure the path, so it uses the default path path.data/dead_letter_queue

Test case:

input{
       // kafka

}

output{
    // elastic
}

I'm consuming payload from Kafka and writing into elastic search. I've sent a huge payload, by default elastic will index only 1000 fields. In this case it's giving 400 error.

"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of total fields [1000] has been exceeded"}}}}

Since it's a 400 message, it should go to the DLQ queue, right? But I'm not able to see the messages in that path /usr/share/logstash/data/dead_letter_queue.

Did I miss anything in the DLQ config?

0

There are 0 best solutions below