Logstash raising json_parse_exception when input events are coming from elastisearch

Elastic Stack Logstash
1

here is my conf

input {

Read all documents from Elasticsearch matching the given query

elasticsearch {
hosts => "localhost:9200"
index => "77777"
query => '{ "query": { "match": { "func_name": "MDM_TunerStatusPrint" } }, "sort": [ "_doc" ] }'
}
}

output {
stdout { codec => rubydebug }
}

I have not found any specific answer in web. I ran logstash in debug mode and what all i have is following logs.

017-07-22T13:44:01,669][ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Elasticsearch hosts=>["localhost:9200"], index=>"77777", query=>"{ "query": { "match": { "func_name": "MDM_TunerStatusPrint" } }, "sort": [ "_doc" ] }", id=>"ba8598acc8ce6756b5e534327429075836e1b1dc-1", enable_metric=>true, codec=><LogStash::Codecs::JSON id=>"json_1a8e4e52-ba91-4e48-bfba-d6c5f00f7c3a", enable_metric=>true, charset=>"UTF-8">, size=>1000, scroll=>"1m", docinfo=>false, docinfo_target=>"@metadata", docinfo_fields=>["_index", "_type", "_id"], ssl=>false>
Error: [400] {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Failed to parse request body"}],"type":"illegal_argument_exception","reason":"Failed to parse request body","caused_by":{"type":"json_parse_exception","reason":"Unrecognized token 'DnF1ZXJ5VGhlbkZldGNoBQAAAAAAABk7FlNMVllXby1CU3JLbW5JQVRybmFPOEEAAAAAAAAZPBZTTFZZV28tQlNyS21uSUFUcm5hTzhBAAAAAAAAGT0WU0xWWVdvLUJTckttbklBVHJuYU84QQAAAAAAABk': was expecting ('true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@44a71fa; line: 1, column: 157]"}},"status":400}
[2

Any help is much appreciated.

2

Looks like its a bug in logstash-elasticsearch plugin in Logstash 5.3.0 and 5.4.0 as there is strict content-type checking is involved. Its fixed in 5.4.1. Better to update the plugin bin/logstash-plugin update logstash-input-elasticsearch

Issue fixed: https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/66

This solves my above problem

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.