# Failed to parse expression **URL:** \ **Category:** Elasticsearch\ **Created:** [June 22, 2017, 2:16pm UTC](https://discuss.elastic.co/t/failed-to-parse-expression/90478 "2017-06-22T14:16:38Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![supp](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@supp](https://discuss.elastic.co/u/supp)\ **Post date:** [June 22, 2017, 2:16pm UTC](https://discuss.elastic.co/t/failed-to-parse-expression/90478/1 "2017-06-22T14:16:38Z")
Hello averyone. Everithing was fine, untill i'v got error. IDK when error occurs first time and when something going wrong (maybe some one uploaded new template or else), but when i open index log\_query\*, on top of kibana appears: Discover: parse\_exception: unexpected token 'doc['geoip.country\_code3.raw'].value' on line (1) position (7) was expecting one of -processing search and there is no info. -in log /var/log/elasticsearch/logs.log: [details=Summary]Caused by: ScriptException[Failed to parse expression: return doc['geoip.country\_code3.raw'].value]; nested: NotSerializableExceptionWrapper[parse\_exception: unexpected token 'doc['geoip.country\_code3.raw'].value' on line (1) position (7) was expecting one of ]; Caused by: NotSerializableExceptionWrapper[parse\_exception: unexpected token 'doc['geoip.country\_code3.raw'].value' on line (1) position (7) was expecting one of ][/details] part of input /etc/logstash/conf.d/01-lumberjack-input.conf jdbc { type =\> "log\_query" jdbc\_driver\_library =\> "/usr/share/java/mysql-connector-java-5.1.39/mysql-connector-java-5.1.39-bin.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_string =\> "jdbc:mysql://192.168.0.104:3306/dbname?zeroDateTimeBehavior=convertToNull&characterEncoding=cp1251&characterSetResults=UTF-8" `# jdbc_paging_enabled => "true"` `# jdbc_page_size => "500"` jdbc\_user =\> "mysql" jdbc\_password =\> "mysqladminpassword" `# sql_log_level => "debug"` schedule =\> "\* \* \* \* \*" statement\_filepath =\> "/etc/logstash/log\_query.sql" `# use_column_value => "true"` `# tracking_column => "log_id"` } part of output /etc/logstash/conf.d/30-lumberjack-output.conf } else if "log\_query" in [tags] or "log\_query" in [type] { elasticsearch { hosts =\> ["192.168.0.105:9200"] index =\> "log\_query-%{+YYYY.MM.dd}" template =\> "/etc/logstash/log\_query\_template.json" template\_name =\> "log\_query-\*" manage\_template =\> "true" document\_id =\> "%{fingerprint}" } /etc/logstash/log\_query.sql SELECT test\_kartoteka.log\_query.id log\_id, date, source, test\_kartoteka.log\_query.cid, type search\_type, found, page, query db\_query, referer, user\_agent, promo\_id, login, tcid, email, fio, lastname, firstname, middlename, phone, po\_address, deposit, dtadd, inn, snils, adv, permissions, es, where\_from, l\_act, block, lupdate, site\_id, name, maintenance, address, INET\_NTOA(ip) ip FROM test\_kartoteka.log\_query LEFT JOIN priv\_office.clients ON priv\_office.clients.cid = test\_kartoteka.log\_query.cid LEFT JOIN search\_v1.searcher ON test\_kartoteka.log\_query.type = search\_v1.searcher.id WHERE test\_kartoteka.log\_query.type \<\> 15 ORDER BY date DESC LIMIT 5000 /etc/logstash/log\_query\_template.json { "template" : "log\_query-_", "settings" : { "index.refresh\_interval" : "60s" }, "mappings" : { "default" : { "\_all" : {"enabled" : true, "omit\_norms" : true}, "dynamic\_templates" : [ { "message\_field" : { "match" : "message", "match\_mapping\_type" : "string", "mapping" : { "type" : "string", "index" : "analyzed", "omit\_norms" : true, "fielddata" : { "format" : "disabled" } } } }, { "string\_fields" : { "match" : "_", "match\_mapping\_type" : "string", "mapping" : { "type" : "string", "index" : "analyzed", "omit\_norms" : true, "fielddata" : { "format" : "disabled" }, "fields" : { "raw" : {"type": "string", "index" : "not\_analyzed", "doc\_values" : true, "ignore\_above" : 256} } } } }, { "float\_fields" : { "match" : "_", "match\_mapping\_type" : "float", "mapping" : { "type" : "float", "doc\_values" : true } } }, { "double\_fields" : { "match" : "_", "match\_mapping\_type" : "double", "mapping" : { "type" : "double", "doc\_values" : true } } }, { "byte\_fields" : { "match" : "_", "match\_mapping\_type" : "byte", "mapping" : { "type" : "byte", "doc\_values" : true } } }, { "short\_fields" : { "match" : "_", "match\_mapping\_type" : "short", "mapping" : { "type" : "short", "doc\_values" : true } } }, { "integer\_fields" : { "match" : "_", "match\_mapping\_type" : "integer", "mapping" : { "type" : "integer", "doc\_values" : true } } }, { "long\_fields" : { "match" : "_", "match\_mapping\_type" : "long", "mapping" : { "type" : "long", "doc\_values" : true } } }, { "date\_fields" : { "match" : "_", "match\_mapping\_type" : "date", "mapping" : { "type" : "date", "doc\_values" : true } } }, { "geo\_point\_fields" : { "match" : "_", "match\_mapping\_type" : "geo\_point", "mapping" : { "type" : "geo\_point", "doc\_values" : true } } } ], "properties" : { "@timestamp": { "type": "date", "doc\_values" : true }, "@version": { "type": "string", "index": "not\_analyzed", "doc\_values" : true }, "length": { "type": "integer", "index": "not\_analyzed", "doc\_values" : true }, "geoip" : { "type" : "object", "dynamic": true, "properties" : { "ip": { "type": "ip", "doc\_values" : true }, "location" : { "type" : "geo\_point", "doc\_values" : true }, "latitude" : { "type" : "float", "doc\_values" : true }, "longitude" : { "type" : "float", "doc\_values" : true } } } } } } } Where is my misunderstood? Where's my mistake? Maybe i should to remove template or re-upload it? I'm unable to create new search, but saved dashboard (i think it linked to index) shows some info. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 20, 2017, 2:16pm UTC](https://discuss.elastic.co/t/failed-to-parse-expression/90478/2 "2017-07-20T14:16:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.