Logstash elasticsearch output plugin - Populating api_key from metadata field does not work

Question

I am using the elasticsearch output plugin of logstash to post my events to elasticsearch. I am using the api_key authentication method. It is all working fine until I have the api_key parameter value hardcoded. For Ex:

api_key => "xxxxxxxxxxxx:yyyyyyyyyyyyyyyy"

where Xs resemble id and Ys the api_key generated using the create api_key security api .

But in my filter I am adding the value to be passed to api_key parameter into a metadata field [@metadata][myapikey] . The idea is use that in the output plugin as shown below

output {
   elasticsearch {
            hosts => ["https://localhost:9200"]
            cacert => 'path-to-ca.crt'
            index => "my-index-name"
            api_key => "%{[@metadata][myapikey]}"
            ssl => true
   }
}

As per my understanding, this should have worked like it would work if we provided the index from a metadata field like index => "%{[@metadata][some-index-name]}" . I have used this for index names successfully before.

Not sure why the same implementation does not work for api_key parameter. I have made sure using stdout plugin that the metadata carries the right value in it, but still see invalid api_key value message when I run this.

Please help here.

Adding full pipeline config

input {
  generator {
    lines => [
          '{"timestamp" : "26/01/2021", "fruit-ID" : "t6789", "vegetable-ID" : "Veg1-1002", "Status" : "OK", "myapikey" : "3p4oIUr-Qxxxxxxx-rA"}'
        ]
    count => 1
    codec => "json"
  }
}

filter {
    
        mutate { 
            add_field => { "[@metadata][myapikey]" => "xxxxxxxxxxx-%{myapikey}" }
            remove_field => ["myapikey"]                    
        }
    
}

output {
    elasticsearch {
            hosts => ["https://localhost:9200"]
            cacert => 'path-to-ca.crt'
            index => "my-index-name"
            api_key => "%{[@metadata][myapikey]}"
            ssl => true
  }
}

Answer 1

I think the reason is because the api_key setting doesn't support the sprintf format .

In contrary to the index settings which supports that format , api_key doesn't , so what happens is that Logstash sends the raw value %{[@metadata][myapikey]} (without resolving it) as the API key and that obviously fails.

I think the main reason behind this design decision is that an API key, much like a password, is not supposed to be a field that travels in each document.