ES Choking on Seemingly Valid JSON

Elastic Stack Elasticsearch
1

Error, with some parameters modified to protect the innocent.

the JSON here does pass the lint validator, is it the empty params : {}
that throws it off?

[2015-03-27 16:00:21,010][DEBUG][action.bulk ] [host / Luis
Buñuel] [eventlog-2015.03][4] failed to execute bulk item (index) index
{[eventlog-2015.03][eventlog][AUxdCR6Q-VLJ8JocD46y],
source[{"@version":"1","@timestamp":"2015-03-27T16:00:20.717-05:00","type":"eventlog","file":"/opt/acc/logs/NNN/MMMMM/OOOOO.log","host":"ZZZZZ","offset":"177473796","cluster":"CB_PROD_ROS","json":{"logEventId":"201503272100163859067253.ZZZZZ.28140","msg":{"time":"2015-03-27T21:00:16Z","appVersion":"FFFFF","eventType":"AAAAAAAAA","responseTime":0,"pulseId":"26a92524-6c5f-417e-a746-86e78278b51f","info":{"item":{"id":"26a92524-6c5f-417e-a746-86e78278b51f","accountId":XXXX,"lastRunOutcome":"success","valueTime":1427489940000,"lastRunDuration":7962,"currentRequestCount":0,"lastRunStartTime":1427490008422,"nextValueDueTime":1427490076384,"cacheTime":60000,"lastRequestCount":6,"running":true}}},"event":{"params":{}}}}]}
org.elasticsearch.index.mapper.MapperParsingException: object mapping for
[eventlog] tried to parse field [json] as object, but got EOF, has a
concrete value been provided to it?
at
org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:495)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:544)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:493)
at
org.elasticsearch.index.shard.IndexShard.prepareCreate(IndexShard.java:438)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardIndexOperation(TransportShardBulkAction.java:432)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:149)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction.performOnPrimary(TransportShardReplicationOperationAction.java:515)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction$1.run(TransportShardReplicationOperationAction.java:422)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/926f9703-c385-4113-a6ec-9bd2f42e065e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

You have mixed plain strings and json objects for field "json" in your data.

This is not allowed.

Jörg

On Fri, Mar 27, 2015 at 10:10 PM, David Kleiner david.kleiner@gmail.com
wrote:

Error, with some parameters modified to protect the innocent.

the JSON here does pass the lint validator, is it the empty params : {}
that throws it off?

[2015-03-27 16:00:21,010][DEBUG][action.bulk ] [host / Luis
Buñuel] [eventlog-2015.03][4] failed to execute bulk item (index) index
{[eventlog-2015.03][eventlog][AUxdCR6Q-VLJ8JocD46y],
source[{"@version":"1","@timestamp":"2015-03-27T16:00:20.717-05:00","type":"eventlog","file":"/opt/acc/logs/NNN/MMMMM/OOOOO.log","host":"ZZZZZ","offset":"177473796","cluster":"CB_PROD_ROS","json":{"logEventId":"201503272100163859067253.ZZZZZ.28140","msg":{"time":"2015-03-27T21:00:16Z","appVersion":"FFFFF","eventType":"AAAAAAAAA","responseTime":0,"pulseId":"26a92524-6c5f-417e-a746-86e78278b51f","info":{"item":{"id":"26a92524-6c5f-417e-a746-86e78278b51f","accountId":XXXX,"lastRunOutcome":"success","valueTime":1427489940000,"lastRunDuration":7962,"currentRequestCount":0,"lastRunStartTime":1427490008422,"nextValueDueTime":1427490076384,"cacheTime":60000,"lastRequestCount":6,"running":true}}},"event":{"params":{}}}}]}
org.elasticsearch.index.mapper.MapperParsingException: object mapping for
[eventlog] tried to parse field [json] as object, but got EOF, has a
concrete value been provided to it?
at
org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:495)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:544)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:493)
at
org.elasticsearch.index.shard.IndexShard.prepareCreate(IndexShard.java:438)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardIndexOperation(TransportShardBulkAction.java:432)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:149)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction.performOnPrimary(TransportShardReplicationOperationAction.java:515)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction$1.run(TransportShardReplicationOperationAction.java:422)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/926f9703-c385-4113-a6ec-9bd2f42e065e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/926f9703-c385-4113-a6ec-9bd2f42e065e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoF99PGh3KhfmPHrN58%2BeaSD8NgALz8TsDGiV0jXc7WD4g%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Got it, thank you Joerg!

On Friday, March 27, 2015 at 3:42:36 PM UTC-7, Jörg Prante wrote:

You have mixed plain strings and json objects for field "json" in your
data.

This is not allowed.

Jörg

On Fri, Mar 27, 2015 at 10:10 PM, David Kleiner <david....@gmail.com
<javascript:>> wrote:

Error, with some parameters modified to protect the innocent.

the JSON here does pass the lint validator, is it the empty params : {}
that throws it off?

[2015-03-27 16:00:21,010][DEBUG][action.bulk ] [host / Luis
Buñuel] [eventlog-2015.03][4] failed to execute bulk item (index) index
{[eventlog-2015.03][eventlog][AUxdCR6Q-VLJ8JocD46y],
source[{"@version":"1","@timestamp":"2015-03-27T16:00:20.717-05:00","type":"eventlog","file":"/opt/acc/logs/NNN/MMMMM/OOOOO.log","host":"ZZZZZ","offset":"177473796","cluster":"CB_PROD_ROS","json":{"logEventId":"201503272100163859067253.ZZZZZ.28140","msg":{"time":"2015-03-27T21:00:16Z","appVersion":"FFFFF","eventType":"AAAAAAAAA","responseTime":0,"pulseId":"26a92524-6c5f-417e-a746-86e78278b51f","info":{"item":{"id":"26a92524-6c5f-417e-a746-86e78278b51f","accountId":XXXX,"lastRunOutcome":"success","valueTime":1427489940000,"lastRunDuration":7962,"currentRequestCount":0,"lastRunStartTime":1427490008422,"nextValueDueTime":1427490076384,"cacheTime":60000,"lastRequestCount":6,"running":true}}},"event":{"params":{}}}}]}
org.elasticsearch.index.mapper.MapperParsingException: object mapping for
[eventlog] tried to parse field [json] as object, but got EOF, has a
concrete value been provided to it?
at
org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:495)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:544)
at
org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:493)
at
org.elasticsearch.index.shard.IndexShard.prepareCreate(IndexShard.java:438)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardIndexOperation(TransportShardBulkAction.java:432)
at
org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:149)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction.performOnPrimary(TransportShardReplicationOperationAction.java:515)
at
org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction$1.run(TransportShardReplicationOperationAction.java:422)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/926f9703-c385-4113-a6ec-9bd2f42e065e%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/926f9703-c385-4113-a6ec-9bd2f42e065e%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/99161954-4cc2-4956-a286-870f04841826%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.