"illegal_argument_exception", "reason"=>"if _id is specified it must not be empty"

Hello,

I have setup a logstash pipeline. It works fine bringing the updates and refreshing the index. However, it throws an error while bringing updates. I am trying to understand the reasons behind.

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "contactsx"
document_type => "contactx"
document_id => "%{symbol}"
}

[2020-05-25T11:59:13,962][WARN ][logstash.outputs.elasticsearch][company_listing] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"", :_index=>"contactsx", :routing=>nil, :_type=>"contactx"}, #LogStash::Event:0x56578469], :response=>{"index"=>{"_index"=>"contactsx", "_type"=>"contactx", "_id"=>"", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"if _id is specified it must not be empty"}}}}

by changing it to this "with a constant "_Z", document_id => "%{symbol}_z", there are no errors.

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "contactsx"
document_type => "contactx"
document_id => "%{symbol}_z"
}

Can you please explain what's going on here?
The column symbol is primary key in the db.
Why does logstash say id is NULL in the first setting?

json sample data

With _Z appended to the pipeline directive

symbol:
HCHC
@version:
1
@timestamp:
2020-05-27
companyname:
HC2 Holdings, Inc.
_id:
HCHC_z
_type:
contactx
_index:
contactsx
_score:
0
################################################################

Without _Z appended
#####################

symbol:
HCHC
companyname:
HC2 Holdings, Inc.
@timestamp:
2020-05-27
@version:
1
_id:
HCHC
_type:
contactx
_index:
contactsx
_score:
0

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.