# Logstash: Could not index event to Elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/176066
**Category:** Logstash
**Created:** [April 9, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/176066 "2019-04-09T15:47:42Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ep4sh](https://discuss.elastic.co/u/ep4sh)
#### Post date: [April 9, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/176066/1 "2019-04-09T15:47:42Z")
I have many many errors in Logstash log:
> [2019-04-09T11:24:48,037][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"applicationlog-nolevel-2019.04.09", :\_type=\>"applicationLog", :routing=\>nil}, #LogStash::Event:0x23524674], :response=\>{"index"=\>{"\_index"=\>"applicationlog-nolevel-2019.04.09", "\_type"=\>"applicationLog", "\_id"=\>"RdbXAWoBMa\_P-s105po6", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [host]", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:9"}}}}}
I understood, that there is an existing template in ES, but something goes wrong - log`s messages contains a new type of [host].
I enabled **dead\_message** in `logstash.yml`:
> dead\_letter\_queue.enable: true
And try to analyze "bad" messages:
> Could not index event to Elasticsearch.
> status: 400,
> action: ["index", {:\_id=\>nil, :\_index=\>"applicationlog-nolevel-2019.04.09",
> :\_type=\>"applicationLog", :routing=\>nil}, #LogStash::Event:0x52502ed4],
> response: {"index"=\>{"\_index"=\>"applicationlog-nolevel-2019.04.09",
> "\_type"=\>"applicationLog", "\_id"=\>"-PQuAmoB8kmt6Ez0MzkO", "status"=\>400,
> "error"=\>{"type"=\>"mapper\_parsing\_exception",
> "reason"=\>"failed to parse [host]",
> "caused\_by"=\>{"type"=\>"illegal\_state\_exception",
> "reason"=\>"Can't get text on a START\_OBJECT at 1:69"}}}}c\> t�����rk
> 2019-04-09T12:59:03.759Z
> ��qjava.util.HashMap�dDATA�x
> org.logstash.ConvertedMap�j@timestamp�vorg.logstash.Timestampx
> 2019-04-09T12:58:59.919Z�kapplication�torg.jruby.RubyStringcAAA�dhost�x
> org.logstash.ConvertedMap�dname�torg.jruby.RubyStringoMY-HOST1���jinstanceId�torg.jruby.RubyStringoMY-HOST1�elevel�torg.jruby.RubyStringgNOLEVEL�vapplicationEnvironment�torg.jruby.RubyStringbQA�gmessage�torg.jruby.RubyStringx2019-04-09 08:58:59,871
>
> INFO [stdout] (Thread-231 (client-global-threads-1377496603))
>
> Priority: 9 Priority Level: high�dtags�x
> org.logstash.ConvertedList��torg.jruby.RubyStringx
> beats\_input\_codec\_plain\_applied��torg.jruby.RubyStringq\_grokparsefailure���clog�x
> org.logstash.ConvertedMap�dfile�x
> org.logstash.ConvertedMap�dpath�torg.jruby.RubyStringt/AAA\_LOGS/server.log�����h@version�torg.jruby.RubyStringa1���dMETA�x
> org.logstash.ConvertedMap�dtype�torg.jruby.RubyStringnapplicationLelasticsearch
In my ES template, `CAT /_template` there is a type of `host_ip`:
```
"host_ip": {
"type": "ip"
},
```
To clarify this issue: is it correct, that Logstash try to index message with another type of field?
(Was) `"ip"` =\> (try to index) `"string"` ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/176066/2 "2019-05-07T15:47:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.