# Action/metadata line \[1\] contains an unknown parameter \[\_script\]

**URL:** <https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548>\
**Category:** Logstash\
**Created:** [October 26, 2022, 3:32pm UTC](https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548 "2022-10-26T15:32:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nimish](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@nimish](https://discuss.elastic.co/u/nimish)\
**Post date:** [October 26, 2022, 3:32pm UTC](https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548/1 "2022-10-26T15:32:41Z")

</div>

facing following issue while updating document using script

```auto
Encountered a retryable error (will retry with exponential backoff)
{
	"error": {
		"root_cause": [
			{
				"type": "illegal_argument_exception",
				"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
			}
		],
		"type": "illegal_argument_exception",
		"reason": "Action/metadata line [1] contains an unknown parameter [_script]"
	},
	"status": 400
}

```

I did analysis from my side were able to identify where it's breaking.

According to this:

> Blockquote  
> Logstash will send the content of the event as `event` attribute inside the `params` .  
> This means the stored script can access the parameters using `params.event.get('<name of the field>')` .  
> Blockquote

But in my case,  
"event" object name was going as empty string under the params object while sending \_bulk request to Elasticsearch.

```auto
{
	"script": {
		"params": {
			"": { // <-- empty string wehereas it should be "event"
				"esDocumentType": "999",
				"@version": "1",
				"IndexedOn": "2022-10-26T11:13:43.9912067+00:00",
				"responses": [
					{
						"responsesId": "test-1",
						"responseKey": "13",
						"countryId": 10
					}
				],			
				"correlationId": "0HMLBESV5J51A:00000001",
				"@timestamp": "2022-10-26T11:13:44.508Z"
			}
		},
		"lang": null // <-- null
	}
}

```

As far as I know this not something that we can modify in logstash file. can anyone help to find cause of this issue?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2022, 3:33pm UTC](https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548/2 "2022-11-23T15:33:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.