# Logstash Parsing error

**URL:** <https://discuss.elastic.co/t/logstash-parsing-error/302618>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [April 18, 2022, 11:51am UTC](https://discuss.elastic.co/t/logstash-parsing-error/302618 "2022-04-18T11:51:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Post date:** [April 18, 2022, 11:51am UTC](https://discuss.elastic.co/t/logstash-parsing-error/302618/1 "2022-04-18T11:51:28Z")

</div>

Hi

Im getting below error while indexing to Elasticsearch

[2022-04-15T17:10:23,235][WARN][logstash.outputs.Elasticsearch][events][e1ee9c29fd20ba0c5ba383dd438a2c18f56af21d370e65cce136d247cd14831b] Could not index event to Elasticsearch. {:status=\>400, :action=\>["update", {:\_id=\>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", :\_index=\>"dashboard\_write", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0x4d94f793], :response=\>{"update"=\>{"\_index"=\>"dashboard-000086", "\_type"=\>"\_doc", "\_id"=\>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to execute script", "caused\_by"=\>{"type"=\>"script\_exception", "reason"=\>"runtime error", "script\_stack"=\>["ctx.\_source.appdata.add(params.event.get('appdata'))", " ^---- HERE"], "script"=\>"if(ctx.\_source.appdata== null) ...", "lang"=\>"painless", "position"=\>{"offset"=\>212, "start"=\>176, "end"=\>228}, "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"dynamic method [java.util.LinkedHashMap, add/1] not found"}}}}}}

In my filter I have below

```auto
  add_field => { "[appdata][accessType]" => "idp_app" }
            add_field => { "[appdata][appName]" => "%{S}" }
            add_field => { "[appdata][eventTime]" => "%{timestamp}" }

```

and my ouput has

```auto
 elasticsearch
            {
               hosts => ["localhost:9200"]
               document_id => "%{sid}"
               index => "dashboard_write"
       
                script => "if(ctx._source.appdata== null)
                         {
                           ctx._source.appdata = new ArrayList(); 
                        } 
                        ctx._source.appdata.add(params.event.get('appdata'))"
              doc_as_upsert => "true"

               action => "update"
			   ilm_enabled => false
            }

```

Field type of appdata is nested.

---

<div class="post-metadata">

**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Post date:** [April 22, 2022, 2:34pm UTC](https://discuss.elastic.co/t/logstash-parsing-error/302618/2 "2022-04-22T14:34:37Z")

</div>

Can someone please provide input?

---

<div class="post-metadata">

**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Post date:** [May 3, 2022, 12:31pm UTC](https://discuss.elastic.co/t/logstash-parsing-error/302618/3 "2022-05-03T12:31:50Z")

</div>

Can some one update please? We are getting this error every single time

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2022, 12:32pm UTC](https://discuss.elastic.co/t/logstash-parsing-error/302618/4 "2022-05-31T12:32:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.