Logstash: Got response code '500' contacting Elasticsearch

[akshatsharma4]

Hi,

I am using elasticseach-oss and logstash-oss 7.0.1 rpm in my docker image, both with searchguard enabled.
ES deployment is going fine and I am able to get searchguard index. But when I deploy logstash, it keeps restarting and finally goes in an error state.

error logs:
"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '500' contacting Elasticsearch at URL 'https://elasticsearch.xxxxx:9200/_xpack' "
"Failed to install template. {:message=>"Got response code '500' contacting Elasticsearch at URL 'https://elasticsearch.xxxxx:9200/_xpack'"

my query here is: why is it trying to contact xpack when I am using oss version of elasticsearch and logstash? How can I resolve this error?

[jsvd]

it is only checking to see if x-pack is enabled or not. can you confirm that this error comes from searchguard?
typically an elasticsearch instance would return a 400 error on a request such as /_xpack or /_something, and we use that code to know ilm isn't installed

[akshatsharma4]

I am not entirely sure but mostly, yes. Because when I install elasticsearch and logstash without searchguard, it works just fine.
Anyway, as suggested by you, setting ilm_enabled => false in my logstash configuration for elasticsearch output resolved this issue.

Thanks!