Action/metadata line [1] contains an unknown parameter [_script]

facing following issue while updating document using script

Encountered a retryable error (will retry with exponential backoff)
{
	"error": {
		"root_cause": [
			{
				"type": "illegal_argument_exception",
				"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
			}
		],
		"type": "illegal_argument_exception",
		"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
	},
	"status": 400
}

I did analysis from my side were able to identify where it's breaking.

According to this:

Blockquote
Logstash will send the content of the event as event attribute inside the params .
This means the stored script can access the parameters using params.event.get('<name of the field>') .
Blockquote

But in my case,
"event" object name was going as empty string under the params object while sending _bulk request to Elasticsearch.

{
	"script": {
		"params": {
			"": {   // <-- empty string wehereas it should be "event"
				"esDocumentType": "999",
				"@version": "1",
				"IndexedOn": "2022-10-26T11:13:43.9912067+00:00",
				"responses": [
					{
						"responsesId": "test-1",
						"responseKey": "13",
						"countryId": 10
					}
				],			
				"correlationId": "0HMLBESV5J51A:00000001",
				"@timestamp": "2022-10-26T11:13:44.508Z"
			}
		},
		"lang": null  // <-- null
	}
}

As far as I know this not something that we can modify in logstash file. can anyone help to find cause of this issue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.