# Could not index event to Elasticsearch status 400
**URL:** https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648
**Category:** Logstash
**Created:** [October 2, 2018, 6:03am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648 "2018-10-02T06:03:14Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [October 2, 2018, 6:03am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648/1 "2018-10-02T06:03:14Z")
Hi All,
I am getting the following error while index a document:
> [2018-10-02T08:00:11,897][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"clog-2018.10.02", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x23999e37], :response=\>{"index"=\>{"\_index"=\>"clog-2018.10.02", "\_type"=\>"doc", "\_id"=\>"mNRcM2YBN0hyJV\_JzDLg", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [host]", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:520"}}}}}
This of course is a problem. Is there a way to dump the document that is causing this error?
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [October 2, 2018, 4:30pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648/2 "2018-10-02T16:30:44Z")
So it turns out you can set:
> dead\_letter\_queue.enable: true
> path.dead\_letter\_queue: /opt/logstash/dead\_letter\_queue
That will give you the messages that are cause 400 or 404 error while indexing.
(the path is not required, if not set it defaults to LOGSTASH\_HOME/dead\_letter\_queue/main)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2018, 1:48am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648/4 "2018-11-15T01:48:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.