How to modify logstash in order to send failed message to SQS DLQ

1
votes

I am trying to modify Logstash 7.6 in order to send failed messages to a SQS DLQ [1]. Specifically, I need this modification when Logstash uses a SQS input plugin and elasticsearch output plugin. I do not use nothing in filter part. That is, I have two queues a main queue and its SQS DLQ. The file I am trying to modify is [2]. Only to see if this work I am trying to add an abort after line 325, but the SQS DLQ associated to the main SQS not received any message. Could you give some advice, please?

[1] https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/8804933e2b15d867a049319e52ee61223552b6be/lib/logstash/outputs/elasticsearch/common.rb

[2] https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

PDTA: I know that logstash has its own dlq but I want a SQS DLQ.

1
elasticsearchlogstashamazon-sqs

1 Answers

0
votes

you would want to modify the DLQ write operation to do your own logic.

where action is an ES specific tuple e.g. ['update', { ... }, event] - action[2] gets you the original Logstash event.