# Elasticsearch output splits Json content in to 2 **URL:** \ **Category:** Logstash\ **Created:** [April 12, 2016, 11:03am UTC](https://discuss.elastic.co/t/elasticsearch-output-splits-json-content-in-to-2/47110 "2016-04-12T11:03:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![boazshor](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@boazshor](https://discuss.elastic.co/u/boazshor)\ **Post date:** [April 12, 2016, 11:03am UTC](https://discuss.elastic.co/t/elasticsearch-output-splits-json-content-in-to-2/47110/1 "2016-04-12T11:03:49Z")
Hi, I'm working with Logstash and Elasticserch. I'm trying to insert a Json in to an index in Elasticsearch. my output configuration is : elasticsearch { action =\> "index" hosts =\> "54.215.249.17:9200" index =\> "tenant-1" document\_type =\> "builds" document\_id =\> "build-1" workers =\> 1 } I added a file output as well. In the file I wrote to I can see the Json I passed as I passed it. But when it send an Http call to Elasticsearch I get a 400 Error responce: error":{"root\_cause":[{"type":"illegal\_argument\_exception","reason":"Malformed action/metadata line [3], expected START\_OBJECT or END\_OBJECT but found [VALUE\_STRING]"}],"type":"illegal\_argument\_exception","reason":"Malformed action/metadata line [3], expected START\_OBJECT or END\_OBJECT but found [VALUE\_STRING]"},"status":400} {:class=\>"Elasticsearch::Transport::Transport::Errors::BadRequest", :backtrace=\>["/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/transport/base.rb:146:in `__raise_transport_error'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/transport/base.rb:256:in`perform\_request'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/client.rb:125:in`perform\_request'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.15/lib/elasticsearch/api/actions/bulk.rb:87:in `bulk'", "/home/ubuntu/logstash-2.3.0/vendor/local_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:53:in`non\_threadsafe\_bulk'", "/home/ubuntu/logstash-2.3.0/vendor/local\_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:38:in `bulk'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/home/ubuntu/logstash-2.3.0/vendor/local\_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:38:in `bulk'", "/home/ubuntu/logstash-2.3.0/vendor/local_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/common.rb:163:in`safe\_bulk'", "/home/ubuntu/logstash-2.3.0/vendor/local\_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/common.rb:101:in `submit'", "/home/ubuntu/logstash-2.3.0/vendor/local_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/common.rb:86:in`retrying\_submit'", "/home/ubuntu/logstash-2.3.0/vendor/local\_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/common.rb:29:in `multi_receive'", "org/jruby/RubyArray.java:1653:in`each\_slice'", "/home/ubuntu/logstash-2.3.0/vendor/local\_gems/378aba9b/logstash-output-elasticsearch-2.6.0-java/lib/logstash/outputs/elasticsearch/common.rb:28:in `multi_receive'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/output_delegator.rb:130:in`worker\_multi\_receive'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/output\_delegator.rb:114:in `multi\_receive'", "/home/ubuntu/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:305: (removed some of the trace, the msg was too long ) I added a tcpdump on port 9200 , got that the Json was split in 2. (a nested part was extracted): The original Json is : { "data-raw": { "data": { "result": "SUCCESS", "id": "2016-01-01\_01-01-01", "buildNum":820 } } } And what I get form the tcpdump is: POST /\_bulk HTTP/1.1 Connection: Keep-Alive Content-Length: 157 Content-Type: text/plain; charset=ISO-8859-1 Host: 54.153.44.253:9200 User-Agent: Manticore 0.5.5 Accept-Encoding: gzip,deflate {"index":{"\_id":null,"\_index":"tenant-1","\_type":"builds","\_routing":null}} {"data-raw":{}} {"result":"SUCCESS","buildNum":820,"id":"2016-01-01\_01-01-01"} you can see that the Json was split in to 2 parts, and It looks to me like this is the cuase of the problem, but I can't find the solution. In addition, if I remove the outer Json (the data-raw property): { "data": { "result": "SUCCESS", "id": "2016-01-01\_01-01-01", "buildNum":820 } }} The error does't reoccur. Does anybody have any idea what is the problem and how to fix it? thanks. Boaz. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/elasticsearch-output-splits-json-content-in-to-2/47110/2 "2017-07-06T05:02:47Z")