# Invalid character 'x' in string escape code; pipeline/output.go:92 Failed to publish events: temporary bulk send failure

**URL:** <https://discuss.elastic.co/t/invalid-character-x-in-string-escape-code-pipeline-output-go-92-failed-to-publish-events-temporary-bulk-send-failure/217608>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 3, 2020, 10:54am UTC](https://discuss.elastic.co/t/invalid-character-x-in-string-escape-code-pipeline-output-go-92-failed-to-publish-events-temporary-bulk-send-failure/217608 "2020-02-03T10:54:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![adeel109](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adeel109/32/60305_2.png) [@adeel109](https://discuss.elastic.co/u/adeel109)\
**Post date:** [February 3, 2020, 10:54am UTC](https://discuss.elastic.co/t/invalid-character-x-in-string-escape-code-pipeline-output-go-92-failed-to-publish-events-temporary-bulk-send-failure/217608/1 "2020-02-03T10:54:59Z")

</div>

Hi All,

I am getting below error when starting filebeat:

2020-02-03T10:31:21.416Z ERROR reader/json.go:32 Error decoding JSON: invalid character 'x' in string escape code  
2020-02-03T10:31:22.467Z INFO elasticsearch/client.go:690 Connected to Elasticsearch version 7.5.1

|2020-02-03T10:31:23.474Z|ERROR|pipeline/output.go:92|Failed to publish events: temporary bulk send failure|  
|2020-02-03T10:31:23.475Z|INFO|elasticsearch/client.go:690|Connected to Elasticsearch version 7.5.1|  
|2020-02-03T10:31:24.482Z|ERROR|pipeline/output.go:92|Failed to publish events: temporary bulk send failure|  
|2020-02-03T10:31:24.484Z|INFO|elasticsearch/client.go:690|Connected to Elasticsearch version 7.5.1|  
|2020-02-03T10:31:25.491Z|ERROR|pipeline/output.go:92|Failed to publish events: temporary bulk send failure|

filebeat config:

```auto
- type: log
  enabled: true
  paths:
  - /var/log/nginx/test4.json
  json:
    keys_under_root: true
    add_error_key: true
  fields:
    app_name: "nginx"
    hostname: "localhost"
  fields_under_root: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "test4-%{[fields.hostname]}-%{+YYYY}"
setup.template:
  name: "test4-%{[fields.hostname]}"
  pattern: "test4-%{[fields.hostname]}-*"
  enabled: false

```

log file format:

log\_format json '{'  
'"client\_ip": "$remote\_addr",'  
'"client\_port": "$remote\_port",'  
'"remote\_user": "$remote\_user",'  
'"@timestamp": "$time\_local",'  
'"http\_request": "$request",'  
'"http\_status\_code": "$status",'  
'"request\_time": "$request\_time",'  
'"body\_bytes\_sent": "$body\_bytes\_sent",'  
'"rh\_http\_referer": "$http\_referer",'  
'"agent": "$http\_user\_agent",'  
'"http\_x\_forwarded\_for": "$http\_x\_forwarded\_for",'  
'"upstream\_response\_time": "$upstream\_response\_time",'  
'"uuid" : "$http\_x\_unique\_id",'  
'"authorization" : "$http\_authorization",'  
'"x\_auth\_timestamp" : "$http\_x\_auth\_timestamp",'  
'"data\_version" : "$http\_x\_nfer\_data",'  
'"session\_info" : "$http\_cookie",'  
'"user\_email" : "$http\_x\_nfer\_user",'  
'"upstream\_connect\_time" : "$upstream\_connect\_time",'  
'"upstream\_response\_time" : "$upstream\_response\_time",'  
'"process\_time" : "$request\_time "'  
'}';  
log file:

```json
{"client_ip": "1.2.3.4","client_port": "56268","remote_user": "-","@timestamp": "03/Feb/2020:09:45:47 +0000","http_request": "POST /endpoint/some/app HTTP/1.1","http_status_code": "200","request_time": "0.261","body_bytes_sent": "7362","rh_http_referer": "http://adeel.domain.com/results?query=some_query","agent": "python-requests/2.19.1","http_forwarded_for": "2.2.2.2","upstream_response_time": "0.261","uuid" : "2345236:w4t2346_343454236:346326","authorization" : "-","auth_timestamp" : "-","data_version" : "2","session_info" : "cookie","user_email" : "user@email","upstream_connect_time" : "0.001","upstream_response_time" : "0.261","process_time" : "0.261 "}

```

However, when I remove field data from output.elasticsearch index section, like below, I stiil get one error but the logs are pushed. I need to put field data in index name, please help.

```auto
- type: log
  enabled: true
  paths:
  - /var/log/nginx/test4.json
  json:
    keys_under_root: true
    add_error_key: true
  fields:
    app_name: "nginx"
    hostname: "localhost"
  fields_under_root: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "test4-%{+YYYY}"
setup.template:
  name: "test4"
  pattern: "test4-*"
  enabled: false

```

error

2020-02-03T10:52:02.351Z ERROR reader/json.go:32 Error decoding JSON: invalid character 'x' in string escape code

Despite this error, the logs are pushed.

My questions:

1. What does 'invalid character 'x' in string escape code' mean?
2. Why does including field in index name give temporary bulk send failure?
3. How do I fix this.

P.S.: I should mention that i am trying to push from filebeat version 6.2 to elasticsearch version 7.5

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2020, 10:55am UTC](https://discuss.elastic.co/t/invalid-character-x-in-string-escape-code-pipeline-output-go-92-failed-to-publish-events-temporary-bulk-send-failure/217608/2 "2020-03-02T10:55:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.