# Getting error "Could not index event to Elasticsearch" in logstash? **URL:** \ **Category:** Logstash\ **Created:** [May 11, 2023, 11:07am UTC](https://discuss.elastic.co/t/getting-error-could-not-index-event-to-elasticsearch-in-logstash/333198 "2023-05-11T11:07:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Post date:** [May 11, 2023, 11:07am UTC](https://discuss.elastic.co/t/getting-error-could-not-index-event-to-elasticsearch-in-logstash/333198/1 "2023-05-11T11:07:30Z")
Using Logstash version 7.4.3 logstash-filter-json plugin. **filter { json { source =\> "message" } }** logs are:- {"Event":"SparkListenerJobStart","Job ID":1,"Submission Time":1640751467318,"Stage Infos":[{"Stage ID":1,"Stage Attempt ID":0,"Stage Name":"mapToPair at JavaNetworkWordCount.java:66","Number of Tasks":0,"RDD Info":[{"RDD ID":3,"Name":"MapPartitionsRDD","Scope":"{"id":"3\_1640751467000","name":"map @ 09:47:47"}","Callsite":"mapToPair at JavaNetworkWordCount.java:66","Parent IDs":[2],"Storage Level":{"Use Disk":false,"Use Memory":false,"Deserialized":false,"Replication":1},"Barrier":false,"Number of Partitions":0,"Number of Cached Partitions":0,"Memory Size":0,"Disk Size":0},{"RDD ID":2,"Name":"MapPartitionsRDD","Scope":"{"id":"2\_1640751467000","name":"flatMap @ 09:47:47"}","Callsite":"flatMap at JavaNetworkWordCount.java:65","Parent IDs":[1],"Storage Level":{"Use Disk":false,"Use Memory":false,"Deserialized":false,"Replication":1},"Barrier":false,"Number of Partitions":0,"Number of Cached Partitions":0,"Memory Size":0,"Disk Size":0},{"RDD ID":1,"Name":"BlockRDD","Scope":"{"id":"1\_1640751467000","name":"socket text stream [0]\n@ 09:47:47"}","Callsite":"socketTextStream at JavaNetworkWordCount.java:63","Parent IDs":,"Storage Level":{"Use Disk":false,"Use Memory":false,"Deserialized":false,"Replication":1},"Barrier":false,"Number of Partitions":0,"Number of Cached Partitions":0,"Memory Size":0,"Disk Size":0}],"Parent IDs":,"Details":"org.apache.spark.streaming.api.java.AbstractJavaDStreamLike.mapToPair(JavaDStreamLike.scala:42)\norg.apache.spark.examples.streaming.JavaNetworkWordCount.main(JavaNetworkWordCount.java:66)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52)\norg.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:951)\norg.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:180)\norg.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:203)\norg.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:90)\norg.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:1030)\norg.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:1039)\norg.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)","Accumulables":,"Resource Profile Id":0},{"Stage ID":2,"Stage Attempt ID":0,"Stage Name":"print at JavaNetworkWordCount.java:69","Number of Tasks":1,"RDD Info":[{"RDD ID":4,"Name":"ShuffledRDD","Scope":"{"id":"4\_1640751467000","name":"reduceByKey\n@ 09:47:47"}","Callsite":"reduceByKey at JavaNetworkWordCount.java:67","Parent IDs":[3],"Storage Level":{"Use Disk":false,"Use Memory":false,"Deserialized":false,"Replication":1},"Barrier":false,"Number of Partitions":7,"Number of Cached Partitions":0,"Memory Size":0,"Disk Size":0}],"Parent IDs":[1],"Details":"org.apache.spark.streaming.api.java.AbstractJavaDStreamLike.print(JavaDStreamLike.scala:42)\norg.apache.spark.examples.streaming.JavaNetworkWordCount.main(JavaNetworkWordCount.java:69)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52)\norg.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:951)\norg.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:180)\norg.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:203)\norg.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:90)\norg.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:1030)\norg.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:1039)\norg.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)","Accumulables":,"Resource Profile Id":0}],"Stage IDs":[1,2],"Properties":{"spark.checkpoint.checkpointAllMarkedAncestors":"true","spark.job.interruptOnCancel":"false","callSite.long":"org.apache.spark.streaming.api.java.AbstractJavaDStreamLike.print(JavaDStreamLike.scala:42)\norg.apache.spark.examples.streaming.JavaNetworkWordCount.main(JavaNetworkWordCount.java:69)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52)\norg.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:951)\norg.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:180)\norg.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:203)\norg.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:90)\norg.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:1030)\norg.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:1039)\norg.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)","spark.rdd.scope":"{"id":"5\_1640751467000","name":"print @ 09:47:47"}","callSite.short":"print at JavaNetworkWordCount.java:69","spark.streaming.internal.outputOpId":"0","spark.rdd.scope.noOverride":"true","spark.job.description":"Streaming job from \[output operation 0, batch time 09:47:47]","spark.streaming.internal.batchTime":"1640751467000"}} getting error in logstash.log file:- [2023-05-10T17:23:24,179][WARN][logstash.outputs.elasticsearch][main] Could not index event to elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"spark\_json\_tier-2023-05-10", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x4938756a], :response=\>{"index"=\>{"\_index"=\>"spark\_json\_tier-2023-05-10", "\_type"=\>"\_doc", "\_id"=\>"gM-CBYgBsEObqebTRxWy", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [Properties.spark.rdd.scope] of different type, current\_type [keyword], merged\_type [ObjectMapper]"}}}} ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [May 11, 2023, 11:47am UTC](https://discuss.elastic.co/t/getting-error-could-not-index-event-to-elasticsearch-in-logstash/333198/2 "2023-05-11T11:47:25Z")
Hi @talbehat, Can you check the mapping of your index, particularly for the `scope` field? It looks like you have a value that doesn't match the expected field type. > [@talbehat](#): > > mapper [Properties.spark.rdd.scope] of different type, current\_type [keyword], merged\_type [ObjectMapper] From the above error and the log event you have shared it looks like your mapping is expecting text as the field is of type `keyword`, but the log extract shows that it is an object. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 8, 2023, 11:48am UTC](https://discuss.elastic.co/t/getting-error-could-not-index-event-to-elasticsearch-in-logstash/333198/3 "2023-06-08T11:48:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.