# Logstash Plugin es\_bulk - Need a working exampleof bulk indexing
**URL:** https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530
**Category:** Logstash
**Created:** [November 20, 2018, 11:42am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530 "2018-11-20T11:42:31Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [November 20, 2018, 11:42am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/1 "2018-11-20T11:42:32Z")
We are currently posting multiple events to Elastic Search using the /\_bulk endpoint in the format:
```
{"index":{"_type" : "doc", "_id": "1"}}
{"category":"DATA","raw": "message 1"}
{"index":{"_type" : "doc", "_id": "2"}}
{"category":"DATA","raw": "message 2"}
...
```
We want to move to using LogStash so we looked at the es\_bulk plugin but cannot get it working and cannot find any examples documented nor in this forum.
```
input {
http {
port => "5051"
codec => "es_bulk"
}
}
output {
stdout {
codec => rubydebug { metadata => false }
}
}
```
POSTing the above to port 5051 Produces the output:
```
{
"index" => {
"_type" => "doc"
},
"headers": {
...
}
}
```
So, only one event (which doesn't contain the fields `category` or `raw`) is generated thus it's only picking up the first line of what we POST and not, as I would expect, treating each pair of lines as a single event with the actual message in every second line.
Has anyone got an example or better documentation than [this](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-es_bulk.html)?
---
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [December 17, 2018, 6:30am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/2 "2018-12-17T06:30:25Z")
Bump
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 17, 2018, 6:36am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/3 "2018-12-17T06:36:30Z")
What kind of processing are you looking to perform? Where are you sending data? Have you considered using an [ingest node pipeline](https://www.elastic.co/blog/should-i-use-logstash-or-elasticsearch-ingest-nodes) instead?
---
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [December 17, 2018, 6:57am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/4 "2018-12-17T06:57:19Z")
OK, the solution seems to be adding the following header:
`Content-Type: application/x-ndjson`
This results in the content being properly split into different events:
```
{
"headers" => {
...
},
"raw" => "message 1",
"@timestamp" => 2018-12-17T06:53:22.912Z,
"category" => "DATA"
}
{
"headers" => {
...
},
"raw" => "message 2",
"@timestamp" => 2018-12-17T06:53:22.912Z,
"category" => "DATA"
}
```
I got this from the [ES \_bulk documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html). Interestingly ES doesn't care about the Content-Type header but Logstash does.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 17, 2018, 7:08am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/5 "2018-12-17T07:08:44Z")
Which version of the stack are you using? Content type verification has been tightened in recent versions...
---
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [December 17, 2018, 7:08am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/6 "2018-12-17T07:08:47Z")
As I said, until now we have been directly submitting documents to ES and want to move to LogStash so all input comes via LogStash.
Do you have any idea for how we can submit changes/corrections to the ES docs?
[https://www.elastic.co/guide/en/logstash/current/plugins-codecs-es\_bulk.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-es_bulk.html)
---
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [December 18, 2018, 7:30am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/7 "2018-12-18T07:30:49Z")
We're on 6.5 across the board and we're seeing the \_bulk/ API accepts `Content-Type: application/json`.
---
### Author:  [@cawoodm](https://discuss.elastic.co/u/cawoodm)
#### Post date: [January 9, 2019, 8:50am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/8 "2019-01-09T08:50:26Z")
We're also seeing that ES won't accept `application/x-ndjson; charset=utf-8` as a `Content-Type` header though it does accept `application/x-ndjson`.
> {"error":"Content-Type header [application/x-ndjson; charset=utf-8] is not supported","status":406}
The [issue](https://github.com/elastic/elasticsearch/issues/28123) has already been reported.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 6, 2019, 8:50am UTC](https://discuss.elastic.co/t/logstash-plugin-es-bulk-need-a-working-exampleof-bulk-indexing/157530/9 "2019-02-06T08:50:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.