# Could not index event to Elasticsearch. - failed to parse \[host\]

**URL:** <https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908>\
**Category:** Logstash\
**Created:** [September 10, 2018, 7:33am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908 "2018-09-10T07:33:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Victor\_Sava](https://avatars.discourse-cdn.com/v4/letter/v/b782af/32.png) [@Victor\_Sava](https://discuss.elastic.co/u/Victor_Sava)\
**Post date:** [September 10, 2018, 7:33am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/1 "2018-09-10T07:33:31Z")

</div>

```
[WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"point2homesiis-2018.09.10", :_type=>"iis", :_routing=>nil}, #<LogStash::Event:0x5c396f0>], :response=>{"index"=>{"_index"=>"point2homesiis-2018.09.10", "_type"=>"iis", "_id"=>"lnJjwmUBiym8oORci_sq", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:493"}}}}}

```

Hello, I am getting the error above and cant understand why i get it and how to fix it? My .conf file seems to be correct. How can i track down this to find out the source of error and fix it?

---

<div class="post-metadata">

**Author:** ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)\
**Post date:** [September 10, 2018, 10:21am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/2 "2018-09-10T10:21:15Z")

</div>

Please post your config file if you want help with that  
you can debug with: **`--log.level LEVEL`**

see: [https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 11, 2018, 6:13am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/3 "2018-09-11T06:13:11Z")

</div>

Google the error message and you should find several explanations (including a GitHub issue) that explains what's going on.

---

<div class="post-metadata">

**Author:** ![Victor\_Sava](https://avatars.discourse-cdn.com/v4/letter/v/b782af/32.png) [@Victor\_Sava](https://discuss.elastic.co/u/Victor_Sava)\
**Post date:** [September 11, 2018, 7:58am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/4 "2018-09-11T07:58:29Z")

</div>

hi , i found on google multiple articles but i am usure where i have to add what

```
[2018-09-11T02:57:19,852][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"pointiis-2018.09.11", :_type=>"iis", :_routing=>nil}, #<LogStash::Event:0x6f7321ae>], :response=>{"index"=>{"_index"=>"pointiis-2018.09.11", "_type"=>"iis", "_id"=>"2g2ix2UBiym8oORcfkgd", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:142"}}}}

```

You say in one theard:  
Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

Where is that JSON file located? And how to find which json we have to fix?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 11, 2018, 8:01am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/5 "2018-09-11T08:01:32Z")

</div>

> Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

I don't have the context of where I said that but it looks like a completely different problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2018, 8:01am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-failed-to-parse-host/147908/6 "2018-10-09T08:01:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.