# Logstash raising json\_parse\_exception when input events are coming from elastisearch

**URL:** https://discuss.elastic.co/t/logstash-raising-json-parse-exception-when-input-events-are-coming-from-elastisearch/94195
**Category:** Logstash
**Created:** [July 22, 2017, 8:26am UTC](https://discuss.elastic.co/t/logstash-raising-json-parse-exception-when-input-events-are-coming-from-elastisearch/94195 "2017-07-22T08:26:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sushil1016](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sushil1016](https://discuss.elastic.co/u/sushil1016)
#### Post date: [July 22, 2017, 8:26am UTC](https://discuss.elastic.co/t/logstash-raising-json-parse-exception-when-input-events-are-coming-from-elastisearch/94195/1 "2017-07-22T08:26:58Z")

</div>

here is my conf

input {

# Read all documents from Elasticsearch matching the given query

elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "77777"  
query =\> '{ "query": { "match": { "func\_name": "MDM\_TunerStatusPrint" } }, "sort": ["\_doc"] }'  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

I have not found any specific answer in web. I ran logstash in debug mode and what all i have is following logs.

017-07-22T13:44:01,669][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Elasticsearch hosts=\>["localhost:9200"], index=\>"77777", query=\>"{ "query": { "match": { "func\_name": "MDM\_TunerStatusPrint" } }, "sort": ["\_doc"] }", id=\>"ba8598acc8ce6756b5e534327429075836e1b1dc-1", enable\_metric=\>true, codec=\>\<LogStash::Codecs::JSON id=\>"json\_1a8e4e52-ba91-4e48-bfba-d6c5f00f7c3a", enable\_metric=\>true, charset=\>"UTF-8"\>, size=\>1000, scroll=\>"1m", docinfo=\>false, docinfo\_target=\>"@metadata", docinfo\_fields=\>["\_index", "\_type", "\_id"], ssl=\>false\>  
Error: [400] {"error":{"root\_cause":[{"type":"illegal\_argument\_exception","reason":"Failed to parse request body"}],"type":"illegal\_argument\_exception","reason":"Failed to parse request body","caused\_by":{"type":"json\_parse\_exception","reason":"Unrecognized token 'DnF1ZXJ5VGhlbkZldGNoBQAAAAAAABk7FlNMVllXby1CU3JLbW5JQVRybmFPOEEAAAAAAAAZPBZTTFZZV28tQlNyS21uSUFUcm5hTzhBAAAAAAAAGT0WU0xWWVdvLUJTckttbklBVHJuYU84QQAAAAAAABk': was expecting ('true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@44a71fa; line: 1, column: 157]"}},"status":400}  
[2

Any help is much appreciated.

---

<div class="post-metadata">

### Author: ![sushil1016](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sushil1016](https://discuss.elastic.co/u/sushil1016)
#### Post date: [July 22, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-raising-json-parse-exception-when-input-events-are-coming-from-elastisearch/94195/2 "2017-07-22T10:13:33Z")

</div>

Looks like its a bug in logstash-elasticsearch plugin in Logstash 5.3.0 and 5.4.0 as there is strict content-type checking is involved. Its fixed in 5.4.1. Better to update the plugin bin/logstash-plugin update logstash-input-elasticsearch

Issue fixed: [https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/66](https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/66)

This solves my above problem

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 19, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-raising-json-parse-exception-when-input-events-are-coming-from-elastisearch/94195/3 "2017-08-19T10:13:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.