process-check-result Error: broken pipe

[XxTSDTxX]

Hi,

im trying to modify a check-result with logstash. I have a Host with filebeat, that is sending new logfile entries to Logstash on another host. That works perfectly fine.

Now I want to filter the incoming message from filebeat and output it to icinga. But I get the following message when Logstash tries to send the data to icinga:

[WARN ][logstash.outputs.icinga ] Request failed {:host=>"localhost", :port=>5665, :path=>"/v1/actions/process-check-result?service=linArpalertVM%21testService", :body=>"{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}",  :error=>#<IOError: Broken pipe>}

my Icinga api_users.conf config is:

object ApiUser "root" {
  password = "password"
  //client_cn = ""
  permissions = [ "*" ]
}

object ApiUser "icinga" {
  password = "icinga"
  //client_cn = ""
  permissions = [ "*" ]
}

apply Service "testService" {
  import "generic-service"
  check_command = "dummy"
 assign where host.address
}

and my Logstash config looks like the following:

input {
  beats {
    port => 5044
    type => "logs"
  }
}

filter {
  if "new_mac" in [message] {
    mutate {
      replace => { "exit_status" => "2" }
    }
  }
}

output {
  icinga {
    host => 'localhost'
    user => 'icinga'
    password => 'icinga'
    ssl_verify => false
    action => 'process-check-result'
    action_config => {
      exit_status => "%{exit_status}"
      plugin_output => "Placeholder"
    }
    icinga_host => "linArpalertVM"
    icinga_service => "testService"
  }
  stdout { }
}

The command works fine when I enter it manually with curl:

curl -k -u icinga:icinga -H 'Accept: application/json' -X POST 'https://localhost:5665/v1/actions/process-check-result?service=linArpalertVM%21testService' -d "{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}"

If you need any more file content let me now...

I searched almost a week now in the internet but nothing helped...