Error::Forbidden

[martinolmos]

I am running logstash 7.16.2 on an Amazon Linux 2 AMI with the following command:

bin/logstash -f /etc/logstash/conf.d/twitter.conf

Here is the content of twitter.conf:

input {
  twitter {
    id => "twitter_plugin_1"
    consumer_key => "MY_CONSUMER_KEY"
    consumer_secret => "MY_CONSUMER_SECRET"
    oauth_token => "MY_OAUTH_TOKEN"
    oauth_token_secret => "MY_OAUTH_TOKEN_SECRET"
    use_samples => true
  }
}

output {
    stdout {
      codec => json
    }
}

Here is the error:

[WARN ] 2022-01-18 01:11:58.701 [[main]<twitter] twitter - Twitter client error {:message=>"", :exception=>Twitter::Error::Forbidden, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/twitter-6.2.0/lib/twitter/streaming/response.rb:24:in `on_headers_complete'", "org/ruby_http_parser/RubyHttpParser.java:370:in `<<'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/twitter-6.2.0/lib/twitter/streaming/response.rb:19:in `<<'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/twitter-6.2.0/lib/twitter/streaming/connection.rb:20:in `stream'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/twitter-6.2.0/lib/twitter/streaming/client.rb:119:in `request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/twitter-6.2.0/lib/twitter/streaming/client.rb:59:in `sample'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-twitter-4.0.3/lib/logstash/inputs/twitter.rb:146:in `do_run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-twitter-4.0.3/lib/logstash/inputs/twitter.rb:131:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:409:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:400:in `block in start_input'"], :options=>nil}

What am I doing wrong??

[andypiper]

I am guessing that the Twitter Ruby gem being used by this plugin does not support API v2, and that your keys and tokens are from a Twitter Developer Project with Essential (v2 only) access.

[martinolmos]

Yes, this seems to be the problem. So I guess I should close this issue and open a feature request for supporting Twitter API v2.

[andsel]

Seems the same problem happened at elastic/logstash#5834 (comment)