Action/metadata line [1] contains an unknown parameter [_script]

Elastic Stack Logstash
1

facing following issue while updating document using script

Encountered a retryable error (will retry with exponential backoff)
{
	"error": {
		"root_cause": [
			{
				"type": "illegal_argument_exception",
				"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
			}
		],
		"type": "illegal_argument_exception",
		"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
	},
	"status": 400
}

I did analysis from my side were able to identify where it's breaking.

According to this:

Blockquote
Logstash will send the content of the event as event attribute inside the params .
This means the stored script can access the parameters using params.event.get('<name of the field>') .
Blockquote

But in my case,
"event" object name was going as empty string under the params object while sending _bulk request to Elasticsearch.

{
	"script": {
		"params": {
			"": {   // <-- empty string wehereas it should be "event"
				"esDocumentType": "999",
				"@version": "1",
				"IndexedOn": "2022-10-26T11:13:43.9912067+00:00",
				"responses": [
					{
						"responsesId": "test-1",
						"responseKey": "13",
						"countryId": 10
					}
				],			
				"correlationId": "0HMLBESV5J51A:00000001",
				"@timestamp": "2022-10-26T11:13:44.508Z"
			}
		},
		"lang": null  // <-- null
	}
}

As far as I know this not something that we can modify in logstash file. can anyone help to find cause of this issue?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.