# ES with plugin OMELASTICSEARCH (rsyslog) Content type detection for rest requests is deprecated

**URL:** <https://discuss.elastic.co/t/es-with-plugin-omelasticsearch-rsyslog-content-type-detection-for-rest-requests-is-deprecated/101678>\
**Category:** Elasticsearch\
**Created:** [September 25, 2017, 10:48am UTC](https://discuss.elastic.co/t/es-with-plugin-omelasticsearch-rsyslog-content-type-detection-for-rest-requests-is-deprecated/101678 "2017-09-25T10:48:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pierre31](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Pierre31](https://discuss.elastic.co/u/Pierre31)\
**Post date:** [September 25, 2017, 10:48am UTC](https://discuss.elastic.co/t/es-with-plugin-omelasticsearch-rsyslog-content-type-detection-for-rest-requests-is-deprecated/101678/1 "2017-09-25T10:48:47Z")

</div>

Hello

I work with **Elasticsearch 5.2 with OMELASTICSEARCH RSYSLOG plugin in RH EL 7.3**.  
Plugin version is : rsyslog-elasticsearch-7.4.7-16  
It works well , but **log file : elasticsearch\_deprecation.log fills every second** with :

// **Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header** //

The content of RSYSLOG configuration file is:

```
module(load="omelasticsearch") # for outputting to Elasticsearch
# this is for index names to be like: logstash-YYYY.MM.DD
template(name="logstash-index"
  type="list") {
    constant(value="logstash-")
    property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
}

# this is for formatting our syslog in JSON with @timestamp
template(name="plain-syslog"
  type="list") {
    constant(value="{")
      constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"host\":\"") property(name="hostname")
      constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
      constant(value="\",\"tag\":\"") property(name="syslogtag" format="json")
      constant(value="\",\"message\":\"") property(name="msg" format="json")
      constant(value="\"}")
}

# this is where we actually send the logs to Elasticsearch (localhost:9200 by default)
action(type="omelasticsearch"
    server="localhost"
    serverport="9200"
    template="plain-syslog"
    searchIndex="logstash-index"
    dynSearchIndex="on"
    bulkmode="on" # use the bulk API
    action.resumeretrycount="-1" # retry indefinitely if Logsene/Elasticsearch is unreachable
)

```

I do not understand, under theese conditions, from where this message can come which slows down the machine.

Could you help me?

Thank you.

Pierre S.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 25, 2017, 11:07am UTC](https://discuss.elastic.co/t/es-with-plugin-omelasticsearch-rsyslog-content-type-detection-for-rest-requests-is-deprecated/101678/2 "2017-09-25T11:07:15Z")

</div>

Probably you need to ask this on the project [http://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html](http://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html).

Probably it needs to be updated. Check if you have a more recent version.

Content-Type must now be set...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 11:07am UTC](https://discuss.elastic.co/t/es-with-plugin-omelasticsearch-rsyslog-content-type-detection-for-rest-requests-is-deprecated/101678/3 "2017-10-23T11:07:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.