# How to track down a document based on a Logstash error

**URL:** <https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139>\
**Category:** Logstash\
**Created:** [November 15, 2019, 9:33pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139 "2019-11-15T21:33:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tm8747a](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tm8747a](https://discuss.elastic.co/u/tm8747a)\
**Post date:** [November 15, 2019, 9:33pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139/1 "2019-11-15T21:33:32Z")

</div>

I'm getting an error from Logstash that looks like this:

`Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"np-audit-7.4.0-2019.11.14", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x5cb25869>], :response=>{"index"=>{"_index"=>"data-7.4.0-2019.11.14", "_type"=>"_doc", "_id"=>"1NGxcG4B3XBDJAVLu464", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [data.added] of type [text] in document with id '1NGxcG4B3XBDJAVLu464'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:3136"}}}}}`

I'm trying to figure out how to get back to the document that caused the error (shipped from filebeat) based on the document ID 1NGxcG4B3XBDJAVLu464. We have filebeat setup on a number of servers shipping those logs, I'm not sure if filebeat is setting that ID or Logstash creates it once it receives the document. Bottomline, I'd like to see what the document looks like to see what's wrong with it and why it's causing an error, but I have no clue how to work my way back to the document/log record.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 15, 2019, 10:14pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139/2 "2019-11-15T22:14:44Z")

</div>

Use a [DLQ](https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html)?

---

<div class="post-metadata">

**Author:** ![tm8747a](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tm8747a](https://discuss.elastic.co/u/tm8747a)\
**Post date:** [November 18, 2019, 2:31pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139/3 "2019-11-18T14:31:17Z")

</div>

We're putting DLQ in place now, but it was not setup when the error happened. Is that the only option?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 18, 2019, 2:33pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139/4 "2019-11-18T14:33:00Z")

</div>

It's the only one I can think of.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2019, 2:33pm UTC](https://discuss.elastic.co/t/how-to-track-down-a-document-based-on-a-logstash-error/208139/5 "2019-12-16T14:33:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.