# Can't get text on a START\_OBJECT
**URL:** https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408
**Category:** Logstash
**Created:** [March 29, 2017, 5:52am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408 "2017-03-29T05:52:54Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [March 29, 2017, 5:52am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/1 "2017-03-29T05:52:54Z")
Hello,
I have many errors in my logstash logs:
> "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [datetime]", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:688"}}
Also my mapping:
> "datetime" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore\_above" : 256
> }
> }
> },
How to fix this? Change type? I don't use this field...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2017, 5:55am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/2 "2017-03-29T05:55:34Z")
Why keep it around if you don't use it? It looks like the field is mapped as a text field but the `datetime` field of an event you're trying to send to ES actually contains an object.
---
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [March 29, 2017, 6:21am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/3 "2017-03-29T06:21:57Z")
ELK in the implementation phase...There are many many fields, mess in the logs)
Is it easier to delete this field in the logstash filter?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2017, 6:23am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/4 "2017-03-29T06:23:52Z")
> Is it easier to delete this field in the logstash filter?
That's what I'd do if the field isn't worth keeping.
---
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [March 29, 2017, 7:53am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/5 "2017-03-29T07:53:21Z")
Yes, it help me.
Also I have:
> Error parsing json {:source=\>"message", :raw=\>"{"SOURCE":"s\_src","PROGRAM":"task-run","MSGID":"5695103","MSEC":006,"MESSAGE":"init: task-run (consumer-22) main process ended, respawning","ISODATE":"2017-03-29T10:50:52+03:00","HOST\_FROM":"test.local","HOST":"test.local","FILE\_NAME":"/dev/kmsg"}\n", :exception=\>#\ at [Source: [B@3966c3c4; line: 1, column: 73]\>}
I understand it because of MSEC. But removing of field don't help
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2017, 8:07am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/6 "2017-03-29T08:07:23Z")
If you actually managed to remove the `MSEC` field I'd expect that the error message changes at least a bit.
---
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [March 29, 2017, 8:11am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/7 "2017-03-29T08:11:47Z")
I tried:
mutate {
remove\_field =\> ["datetime", "MSEC"]
}
And I get absolutely the same errors.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2017, 8:41am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/8 "2017-03-29T08:41:10Z")
Um, wait. The error occurs when the JSON _string_ is being parsed, and at that point there is no `MSEC` field. The JSON spec doesn't allow octal numbers so Logstash is correctly rejecting the bad input.
---
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [March 29, 2017, 10:34am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/9 "2017-03-29T10:34:10Z")
And how it can be bypassed? What can you advise?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2017, 10:55am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/10 "2017-03-29T10:55:53Z")
Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.
---
### Author:  [@cwt](https://discuss.elastic.co/u/cwt)
#### Post date: [April 18, 2017, 5:43am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/11 "2017-04-18T05:43:55Z")
Thank you,
```
if "MSEC" in [message] {
mutate {
gsub => ["message", ",\"MSEC\":.{3},", ","]
}
}
```
It work for me.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 16, 2017, 5:45am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/80408/12 "2017-05-16T05:45:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.