# Failed to parse field \[host\] of type \[text\] after upgrade from 7.17 to 8.12

**URL:** https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734
**Category:** Logstash
**Created:** [February 20, 2024, 11:41pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734 "2024-02-20T23:41:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![snakeapit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snakeapit/32/130803_2.png) [@snakeapit](https://discuss.elastic.co/u/snakeapit)
#### Post date: [February 20, 2024, 11:41pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734/1 "2024-02-20T23:41:13Z")

</div>

Seeing this error below in logstash after upgrade from 7.17 to 8.12, data unable to index to Elasticsearch.

I'm new in Elastics, hopefully someone can assist here. Suspect the change in version 8.12 causing different type for the default field "host"

```auto
response=>{"index"=>{"status"=>400, "error"=>{"type"=>"document_parsing_exception", "reason"=>"[1:888] failed 
to parse field [host] of type [text] in document with id 'XXX-XXX-CUCM-1_4_236ab2df-4e78-44e4-b759-53ad3c48b763'. Preview of field's value: '{na
me=teknslev02esl}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:865"}}}}}
[2024-02-16T15:34:32,095][WARN][logstash.outputs.elasticsearch][cucm-cdr][cucm-cdr-output] Could not index event to Elasticsearch. {:status=>40
0, 

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 21, 2024, 12:14am UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734/2 "2024-02-21T00:14:49Z")

</div>

> [@snakeapit](#):
>
> `document_parsing_exception`

See [this](https://discuss.elastic.co/t/problem-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch-wazuh-alerts-3-x-2020-05-30/235038/6) thread.

Not sure what changed between 7.17 and 8.12. Perhaps the change in ECS compatibility described in the _Breaking changes_ section of the [8.0 release notes](https://www.elastic.co/guide/en/logstash/current/logstash-8-0-0.html).

---

<div class="post-metadata">

### Author: ![snakeapit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snakeapit/32/130803_2.png) [@snakeapit](https://discuss.elastic.co/u/snakeapit)
#### Post date: [March 11, 2024, 10:37pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734/3 "2024-03-11T22:37:14Z")

</div>

Thanks @Badger for your input. The issue resolved by adding the following to .conf file

```
mutate {
    rename => { "[host][name]" => "host" }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 8, 2024, 10:37pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-after-upgrade-from-7-17-to-8-12/353734/4 "2024-04-08T22:37:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.